--- /dev/null
+From 4f90179b2bf72bd7de78879f8de88f36c314e60c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 10:31:20 -0700
+Subject: ACPICA: Do not increment operation_region reference counts for field
+ units
+
+From: Erik Kaneda <erik.kaneda@intel.com>
+
+[ Upstream commit 6a54ebae6d047c988a31f5ac5a64ab5cf83797a2 ]
+
+ACPICA commit e17b28cfcc31918d0db9547b6b274b09c413eb70
+
+Object reference counts are used as a part of ACPICA's garbage
+collection mechanism. This mechanism keeps track of references to
+heap-allocated structures such as the ACPI operand objects.
+
+Recent server firmware has revealed that this reference count can
+overflow on large servers that declare many field units under the
+same operation_region. This occurs because each field unit declaration
+will add a reference count to the source operation_region.
+
+This change solves the reference count overflow for operation_regions
+objects by preventing fieldunits from incrementing their
+operation_region's reference count. Each operation_region's reference
+count will not be changed by named objects declared under the Field
+operator. During namespace deletion, the operation_region namespace
+node will be deleted and each fieldunit will be deleted without
+touching the deleted operation_region object.
+
+Link: https://github.com/acpica/acpica/commit/e17b28cf
+Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exprep.c | 4 ----
+ drivers/acpi/acpica/utdelete.c | 6 +-----
+ 2 files changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
+index a4e306690a21b..4a0f03157e082 100644
+--- a/drivers/acpi/acpica/exprep.c
++++ b/drivers/acpi/acpica/exprep.c
+@@ -473,10 +473,6 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)
+ (u8)access_byte_width;
+ }
+ }
+- /* An additional reference for the container */
+-
+- acpi_ut_add_reference(obj_desc->field.region_obj);
+-
+ ACPI_DEBUG_PRINT((ACPI_DB_BFIELD,
+ "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n",
+ obj_desc->field.start_field_bit_offset,
+diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
+index c365faf4e6cd4..4c0d4e4341961 100644
+--- a/drivers/acpi/acpica/utdelete.c
++++ b/drivers/acpi/acpica/utdelete.c
+@@ -568,11 +568,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
+ next_object = object->buffer_field.buffer_obj;
+ break;
+
+- case ACPI_TYPE_LOCAL_REGION_FIELD:
+-
+- next_object = object->field.region_obj;
+- break;
+-
+ case ACPI_TYPE_LOCAL_BANK_FIELD:
+
+ next_object = object->bank_field.bank_obj;
+@@ -613,6 +608,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
+ }
+ break;
+
++ case ACPI_TYPE_LOCAL_REGION_FIELD:
+ case ACPI_TYPE_REGION:
+ default:
+
+--
+2.25.1
+
--- /dev/null
+From c767a9d894e66373fec25404c167e2fadf66adbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 09:34:51 +0100
+Subject: agp/intel: Fix a memory leak on module initialisation failure
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit b975abbd382fe442713a4c233549abb90e57c22b ]
+
+In intel_gtt_setup_scratch_page(), pointer "page" is not released if
+pci_dma_mapping_error() return an error, leading to a memory leak on
+module initialisation failure. Simply fix this issue by freeing "page"
+before return.
+
+Fixes: 0e87d2b06cb46 ("intel-gtt: initialize our own scratch page")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200522083451.7448-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/agp/intel-gtt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index 4b34a5195c653..5bfdf222d5f90 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -304,8 +304,10 @@ static int intel_gtt_setup_scratch_page(void)
+ if (intel_private.needs_dmar) {
+ dma_addr = pci_map_page(intel_private.pcidev, page, 0,
+ PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+- if (pci_dma_mapping_error(intel_private.pcidev, dma_addr))
++ if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) {
++ __free_page(page);
+ return -EINVAL;
++ }
+
+ intel_private.scratch_page_dma = dma_addr;
+ } else
+--
+2.25.1
+
--- /dev/null
+From 6622216f68d2ee7f3671c5ca46ee40f50d8ceb82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2020 20:33:01 +0800
+Subject: ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit f87a4f022c44e5b87e842a9f3e644fba87e8385f ]
+
+if of_find_device_by_node() succeed, at91_pm_sram_init() doesn't have
+a corresponding put_device(). Thus add a jump target to fix the exception
+handling for this function implementation.
+
+Fixes: d2e467905596 ("ARM: at91: pm: use the mmio-sram pool to access SRAM")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20200604123301.3905837-1-yukuai3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 074bde64064e4..2aab043441e8f 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -592,13 +592,13 @@ static void __init at91_pm_sram_init(void)
+ sram_pool = gen_pool_get(&pdev->dev, NULL);
+ if (!sram_pool) {
+ pr_warn("%s: sram pool unavailable!\n", __func__);
+- return;
++ goto out_put_device;
+ }
+
+ sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz);
+ if (!sram_base) {
+ pr_warn("%s: unable to alloc sram!\n", __func__);
+- return;
++ goto out_put_device;
+ }
+
+ sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base);
+@@ -606,12 +606,17 @@ static void __init at91_pm_sram_init(void)
+ at91_pm_suspend_in_sram_sz, false);
+ if (!at91_suspend_sram_fn) {
+ pr_warn("SRAM: Could not map\n");
+- return;
++ goto out_put_device;
+ }
+
+ /* Copy the pm suspend handler to SRAM */
+ at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn,
+ &at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz);
++ return;
++
++out_put_device:
++ put_device(&pdev->dev);
++ return;
+ }
+
+ static bool __init at91_is_pm_mode_active(int pm_mode)
+--
+2.25.1
+
--- /dev/null
+From eaa87338e03d2a5ec6b1e8eff73da7d60f9f2c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jul 2020 01:36:44 +0200
+Subject: ARM: dts: at91: sama5d3_xplained: change phy-mode
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 7dbf4bbf1c320d82058878bd44805724d171e1e8 ]
+
+Since commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
+KSZ9031 PHY"), networking is broken on sama5d3 xplained.
+
+The device tree has phy-mode = "rgmii" and this worked before, because
+KSZ9031 PHY started with default RGMII internal delays configuration (TX
+off, RX on 1.2 ns) and MAC provided TX delay. After above commit, the
+KSZ9031 PHY starts handling phy mode properly and disables RX delay, as
+result networking is become broken.
+
+Fix it by switching to phy-mode = "rgmii-rxid" to reflect previous
+behavior.
+
+Fixes: bcf3440c6dd78bfe ("net: phy: micrel: add phy-mode support for the KSZ9031 PHY")
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20200717233644.841080-1-alexandre.belloni@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sama5d3_xplained.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+index 61f068a7b362a..7abf555cd2fe3 100644
+--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+@@ -128,7 +128,7 @@ vddana_reg: LDO_REG2 {
+ };
+
+ macb0: ethernet@f0028000 {
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-rxid";
+ #address-cells = <1>;
+ #size-cells = <0>;
+ status = "okay";
+--
+2.25.1
+
--- /dev/null
+From 2cc32c3562e42bcd2640220561c240b04d39fbb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 08:47:59 +0200
+Subject: ARM: dts: exynos: Disable frequency scaling for FSYS bus on Odroid
+ XU3 family
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 9ff416cf45a08f28167b75045222c762a0347930 ]
+
+Commit 1019fe2c7280 ("ARM: dts: exynos: Adjust bus related OPPs to the
+values correct for Exynos5422 Odroids") changed the parameters of the
+OPPs for the FSYS bus. Besides the frequency adjustments, it also removed
+the 'shared-opp' property from the OPP table used for FSYS_APB and FSYS
+busses.
+
+This revealed that in fact the FSYS bus frequency scaling never worked.
+When one OPP table is marked as 'opp-shared', only the first bus which
+selects the OPP sets the rate of its clock. Then OPP core assumes that
+the other busses have been changed to that OPP and no change to their
+clock rates are needed. Thus when FSYS_APB bus, which was registered
+first, set the rate for its clock, the OPP core did not change the FSYS
+bus clock later.
+
+The mentioned commit removed that behavior, what introduced a regression
+on some Odroid XU3 boards. Frequency scaling of the FSYS bus causes
+instability of the USB host operation, what can be observed as network
+hangs. To restore old behavior, simply disable frequency scaling for the
+FSYS bus.
+
+Reported-by: Willy Wolff <willy.mh.wolff.ml@gmail.com>
+Fixes: 1019fe2c7280 ("ARM: dts: exynos: Adjust bus related OPPs to the values correct for Exynos5422 Odroids")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+index ab27ff8bc3dca..afe090578e8fa 100644
+--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+@@ -411,12 +411,6 @@ &bus_fsys_apb {
+ status = "okay";
+ };
+
+-&bus_fsys {
+- operating-points-v2 = <&bus_fsys2_opp_table>;
+- devfreq = <&bus_wcore>;
+- status = "okay";
+-};
+-
+ &bus_fsys2 {
+ operating-points-v2 = <&bus_fsys2_opp_table>;
+ devfreq = <&bus_wcore>;
+--
+2.25.1
+
--- /dev/null
+From 3af750cdfbb31ebc4142f85887b4ecea1e789867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2020 17:58:55 +0200
+Subject: ARM: dts: gose: Fix ports node name for adv7180
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit d344234abde938ae1062edb6c05852b0bafb4a03 ]
+
+When adding the adv7180 device node the ports node was misspelled as
+port, fix this.
+
+Fixes: 8cae359049a88b75 ("ARM: dts: gose: add composite video input")
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/20200704155856.3037010-2-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7793-gose.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts
+index 79baf06019f5a..a378b54867bb4 100644
+--- a/arch/arm/boot/dts/r8a7793-gose.dts
++++ b/arch/arm/boot/dts/r8a7793-gose.dts
+@@ -336,7 +336,7 @@ composite-in@20 {
+ reg = <0x20>;
+ remote = <&vin1>;
+
+- port {
++ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+--
+2.25.1
+
--- /dev/null
+From 7b07fc229b7834dd2fc5d6d75fc60fc4b81abf00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 13:10:16 +0200
+Subject: ARM: dts: gose: Fix ports node name for adv7612
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 59692ac5a7bb8c97ff440fc8917828083fbc38d6 ]
+
+When adding the adv7612 device node the ports node was misspelled as
+port, fix this.
+
+Fixes: bc63cd87f3ce924f ("ARM: dts: gose: add HDMI input")
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/20200713111016.523189-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7793-gose.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts
+index a378b54867bb4..10c3536b8e3d9 100644
+--- a/arch/arm/boot/dts/r8a7793-gose.dts
++++ b/arch/arm/boot/dts/r8a7793-gose.dts
+@@ -394,7 +394,7 @@ hdmi-in@4c {
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ default-input = <0>;
+
+- port {
++ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+--
+2.25.1
+
--- /dev/null
+From 64a62e2a842292080187d462879a0cc3fdc201f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 13:43:24 +0200
+Subject: ARM: dts: stm32: Fix spi4 pins in stm32mp15-pinctrl
+
+From: Patrick Delaunay <patrick.delaunay@st.com>
+
+[ Upstream commit 4fe663890ac5b3b099f458b20cce13fe8efec12b ]
+
+Move spi4_pins_a nodes from pinctrl_z to pinctrl as the associated pins
+are not in BANK Z.
+
+Fixes: 498a7014989d ("ARM: dts: stm32: Add missing pinctrl entries for STM32MP15")
+
+Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 28 ++++++++++++------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+index 49132921feeb9..cc505458da2fd 100644
+--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+@@ -1654,6 +1654,20 @@ pins2 {
+ };
+ };
+
++ spi4_pins_a: spi4-0 {
++ pins {
++ pinmux = <STM32_PINMUX('E', 12, AF5)>, /* SPI4_SCK */
++ <STM32_PINMUX('E', 6, AF5)>; /* SPI4_MOSI */
++ bias-disable;
++ drive-push-pull;
++ slew-rate = <1>;
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('E', 13, AF5)>; /* SPI4_MISO */
++ bias-disable;
++ };
++ };
++
+ usart2_pins_a: usart2-0 {
+ pins1 {
+ pinmux = <STM32_PINMUX('F', 5, AF7)>, /* USART2_TX */
+@@ -1776,18 +1790,4 @@ pins2 {
+ bias-disable;
+ };
+ };
+-
+- spi4_pins_a: spi4-0 {
+- pins {
+- pinmux = <STM32_PINMUX('E', 12, AF5)>, /* SPI4_SCK */
+- <STM32_PINMUX('E', 6, AF5)>; /* SPI4_MOSI */
+- bias-disable;
+- drive-push-pull;
+- slew-rate = <1>;
+- };
+- pins2 {
+- pinmux = <STM32_PINMUX('E', 13, AF5)>; /* SPI4_MISO */
+- bias-disable;
+- };
+- };
+ };
+--
+2.25.1
+
--- /dev/null
+From ca23edf214c3818374c4eecda4e2db6f97c51cfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 09:40:02 +0200
+Subject: ARM: dts: stm32: fix uart nodes ordering in stm32mp15-pinctrl
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit f6b43d89d3b5a31bf4251a26c61e92bf659e74c5 ]
+
+Fix usart and uart nodes ordering. Several usart nodes didn't respect
+expecting ordering.
+
+Fixes: 077e0638fc83 ("ARM: dts: stm32: Add alternate pinmux for USART2 pins on stm32mp15")
+
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 102 +++++++++++------------
+ 1 file changed, 51 insertions(+), 51 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+index 7eb858732d6d0..b31923a9498b5 100644
+--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+@@ -1574,143 +1574,143 @@ pins2 {
+ };
+ };
+
+- usart2_pins_a: usart2-0 {
++ uart4_pins_a: uart4-0 {
+ pins1 {
+- pinmux = <STM32_PINMUX('F', 5, AF7)>, /* USART2_TX */
+- <STM32_PINMUX('D', 4, AF7)>; /* USART2_RTS */
++ pinmux = <STM32_PINMUX('G', 11, AF6)>; /* UART4_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('D', 6, AF7)>, /* USART2_RX */
+- <STM32_PINMUX('D', 3, AF7)>; /* USART2_CTS_NSS */
++ pinmux = <STM32_PINMUX('B', 2, AF8)>; /* UART4_RX */
+ bias-disable;
+ };
+ };
+
+- usart2_sleep_pins_a: usart2-sleep-0 {
+- pins {
+- pinmux = <STM32_PINMUX('F', 5, ANALOG)>, /* USART2_TX */
+- <STM32_PINMUX('D', 4, ANALOG)>, /* USART2_RTS */
+- <STM32_PINMUX('D', 6, ANALOG)>, /* USART2_RX */
+- <STM32_PINMUX('D', 3, ANALOG)>; /* USART2_CTS_NSS */
+- };
+- };
+-
+- usart2_pins_b: usart2-1 {
++ uart4_pins_b: uart4-1 {
+ pins1 {
+- pinmux = <STM32_PINMUX('F', 5, AF7)>, /* USART2_TX */
+- <STM32_PINMUX('A', 1, AF7)>; /* USART2_RTS */
++ pinmux = <STM32_PINMUX('D', 1, AF8)>; /* UART4_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('F', 4, AF7)>, /* USART2_RX */
+- <STM32_PINMUX('E', 15, AF7)>; /* USART2_CTS_NSS */
++ pinmux = <STM32_PINMUX('B', 2, AF8)>; /* UART4_RX */
+ bias-disable;
+ };
+ };
+
+- usart2_sleep_pins_b: usart2-sleep-1 {
+- pins {
+- pinmux = <STM32_PINMUX('F', 5, ANALOG)>, /* USART2_TX */
+- <STM32_PINMUX('A', 1, ANALOG)>, /* USART2_RTS */
+- <STM32_PINMUX('F', 4, ANALOG)>, /* USART2_RX */
+- <STM32_PINMUX('E', 15, ANALOG)>; /* USART2_CTS_NSS */
+- };
+- };
+-
+- usart3_pins_a: usart3-0 {
++ uart4_pins_c: uart4-2 {
+ pins1 {
+- pinmux = <STM32_PINMUX('B', 10, AF7)>; /* USART3_TX */
++ pinmux = <STM32_PINMUX('G', 11, AF6)>; /* UART4_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('B', 12, AF8)>; /* USART3_RX */
++ pinmux = <STM32_PINMUX('B', 2, AF8)>; /* UART4_RX */
+ bias-disable;
+ };
+ };
+
+- uart4_pins_a: uart4-0 {
++ uart7_pins_a: uart7-0 {
+ pins1 {
+- pinmux = <STM32_PINMUX('G', 11, AF6)>; /* UART4_TX */
++ pinmux = <STM32_PINMUX('E', 8, AF7)>; /* UART4_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('B', 2, AF8)>; /* UART4_RX */
++ pinmux = <STM32_PINMUX('E', 7, AF7)>, /* UART4_RX */
++ <STM32_PINMUX('E', 10, AF7)>, /* UART4_CTS */
++ <STM32_PINMUX('E', 9, AF7)>; /* UART4_RTS */
+ bias-disable;
+ };
+ };
+
+- uart4_pins_b: uart4-1 {
++ uart7_pins_b: uart7-1 {
+ pins1 {
+- pinmux = <STM32_PINMUX('D', 1, AF8)>; /* UART4_TX */
++ pinmux = <STM32_PINMUX('F', 7, AF7)>; /* UART7_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('B', 2, AF8)>; /* UART4_RX */
++ pinmux = <STM32_PINMUX('F', 6, AF7)>; /* UART7_RX */
+ bias-disable;
+ };
+ };
+
+- uart4_pins_c: uart4-2 {
++ uart8_pins_a: uart8-0 {
+ pins1 {
+- pinmux = <STM32_PINMUX('G', 11, AF6)>; /* UART4_TX */
++ pinmux = <STM32_PINMUX('E', 1, AF8)>; /* UART8_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('B', 2, AF8)>; /* UART4_RX */
++ pinmux = <STM32_PINMUX('E', 0, AF8)>; /* UART8_RX */
+ bias-disable;
+ };
+ };
+
+- uart7_pins_a: uart7-0 {
++ usart2_pins_a: usart2-0 {
+ pins1 {
+- pinmux = <STM32_PINMUX('E', 8, AF7)>; /* UART4_TX */
++ pinmux = <STM32_PINMUX('F', 5, AF7)>, /* USART2_TX */
++ <STM32_PINMUX('D', 4, AF7)>; /* USART2_RTS */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('E', 7, AF7)>, /* UART4_RX */
+- <STM32_PINMUX('E', 10, AF7)>, /* UART4_CTS */
+- <STM32_PINMUX('E', 9, AF7)>; /* UART4_RTS */
++ pinmux = <STM32_PINMUX('D', 6, AF7)>, /* USART2_RX */
++ <STM32_PINMUX('D', 3, AF7)>; /* USART2_CTS_NSS */
+ bias-disable;
+ };
+ };
+
+- uart7_pins_b: uart7-1 {
++ usart2_sleep_pins_a: usart2-sleep-0 {
++ pins {
++ pinmux = <STM32_PINMUX('F', 5, ANALOG)>, /* USART2_TX */
++ <STM32_PINMUX('D', 4, ANALOG)>, /* USART2_RTS */
++ <STM32_PINMUX('D', 6, ANALOG)>, /* USART2_RX */
++ <STM32_PINMUX('D', 3, ANALOG)>; /* USART2_CTS_NSS */
++ };
++ };
++
++ usart2_pins_b: usart2-1 {
+ pins1 {
+- pinmux = <STM32_PINMUX('F', 7, AF7)>; /* UART7_TX */
++ pinmux = <STM32_PINMUX('F', 5, AF7)>, /* USART2_TX */
++ <STM32_PINMUX('A', 1, AF7)>; /* USART2_RTS */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('F', 6, AF7)>; /* UART7_RX */
++ pinmux = <STM32_PINMUX('F', 4, AF7)>, /* USART2_RX */
++ <STM32_PINMUX('E', 15, AF7)>; /* USART2_CTS_NSS */
+ bias-disable;
+ };
+ };
+
+- uart8_pins_a: uart8-0 {
++ usart2_sleep_pins_b: usart2-sleep-1 {
++ pins {
++ pinmux = <STM32_PINMUX('F', 5, ANALOG)>, /* USART2_TX */
++ <STM32_PINMUX('A', 1, ANALOG)>, /* USART2_RTS */
++ <STM32_PINMUX('F', 4, ANALOG)>, /* USART2_RX */
++ <STM32_PINMUX('E', 15, ANALOG)>; /* USART2_CTS_NSS */
++ };
++ };
++
++ usart3_pins_a: usart3-0 {
+ pins1 {
+- pinmux = <STM32_PINMUX('E', 1, AF8)>; /* UART8_TX */
++ pinmux = <STM32_PINMUX('B', 10, AF7)>; /* USART3_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('E', 0, AF8)>; /* UART8_RX */
++ pinmux = <STM32_PINMUX('B', 12, AF8)>; /* USART3_RX */
+ bias-disable;
+ };
+ };
+--
+2.25.1
+
--- /dev/null
+From 13e391205ffcb7b59724787020d7fea6df178743 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 09:40:03 +0200
+Subject: ARM: dts: stm32: fix uart7_pins_a comments in stm32mp15-pinctrl
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 391e437eedc0dab0a9f2c26997e68e040ae04ea3 ]
+
+Fix uart7_pins_a comments to indicate UART7 pins instead of UART4 pins.
+
+Fixes: bf4b5f379fed ("ARM: dts: stm32: Add missing pinctrl definitions for STM32MP157")
+
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+index b31923a9498b5..49132921feeb9 100644
+--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+@@ -1615,15 +1615,15 @@ pins2 {
+
+ uart7_pins_a: uart7-0 {
+ pins1 {
+- pinmux = <STM32_PINMUX('E', 8, AF7)>; /* UART4_TX */
++ pinmux = <STM32_PINMUX('E', 8, AF7)>; /* UART7_TX */
+ bias-disable;
+ drive-push-pull;
+ slew-rate = <0>;
+ };
+ pins2 {
+- pinmux = <STM32_PINMUX('E', 7, AF7)>, /* UART4_RX */
+- <STM32_PINMUX('E', 10, AF7)>, /* UART4_CTS */
+- <STM32_PINMUX('E', 9, AF7)>; /* UART4_RTS */
++ pinmux = <STM32_PINMUX('E', 7, AF7)>, /* UART7_RX */
++ <STM32_PINMUX('E', 10, AF7)>, /* UART7_CTS */
++ <STM32_PINMUX('E', 9, AF7)>; /* UART7_RTS */
+ bias-disable;
+ };
+ };
+--
+2.25.1
+
--- /dev/null
+From 4cd201f8b76603d1254a28430181e920c59aa2b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jul 2020 00:00:47 +0800
+Subject: ARM: dts: sunxi: bananapi-m2-plus-v1.2: Add regulator supply to all
+ CPU cores
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 55b271af765b0e03d1ff29502f81644b1a3c87fd ]
+
+The device tree currently only assigns the a supply for the first CPU
+core, when in reality the regulator supply is shared by all four cores.
+This might cause an issue if the implementation does not realize the
+sharing of the supply.
+
+Assign the same regulator supply to the remaining CPU cores to address
+this.
+
+Fixes: 6eeb4180d4b9 ("ARM: dts: sunxi: h3-h5: Add Bananapi M2+ v1.2 device trees")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20200717160053.31191-3-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi
+index 22466afd38a3a..a628b5ee72b65 100644
+--- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi
++++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi
+@@ -28,3 +28,15 @@ reg_vdd_cpux: vdd-cpux {
+ &cpu0 {
+ cpu-supply = <®_vdd_cpux>;
+ };
++
++&cpu1 {
++ cpu-supply = <®_vdd_cpux>;
++};
++
++&cpu2 {
++ cpu-supply = <®_vdd_cpux>;
++};
++
++&cpu3 {
++ cpu-supply = <®_vdd_cpux>;
++};
+--
+2.25.1
+
--- /dev/null
+From 5e24f422346bfca6c02cb36cdc011517c6f2472d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jul 2020 00:00:48 +0800
+Subject: ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e4dae01bf08b754de79072441c357737220b873f ]
+
+The Bananapi M2+ uses a GPIO line to change the effective resistance of
+the CPU supply regulator's feedback resistor network. The voltages
+described in the device tree were given directly by the vendor. This
+turns out to be slightly off compared to the real values.
+
+The updated voltages are based on calculations of the feedback resistor
+network, and verified down to three decimal places with a multi-meter.
+
+Fixes: 6eeb4180d4b9 ("ARM: dts: sunxi: h3-h5: Add Bananapi M2+ v1.2 device trees")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20200717160053.31191-4-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi
+index a628b5ee72b65..235994a4a2ebb 100644
+--- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi
++++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi
+@@ -16,12 +16,12 @@ reg_vdd_cpux: vdd-cpux {
+ regulator-type = "voltage";
+ regulator-boot-on;
+ regulator-always-on;
+- regulator-min-microvolt = <1100000>;
+- regulator-max-microvolt = <1300000>;
++ regulator-min-microvolt = <1108475>;
++ regulator-max-microvolt = <1308475>;
+ regulator-ramp-delay = <50>; /* 4ms */
+ gpios = <&r_pio 0 1 GPIO_ACTIVE_HIGH>; /* PL1 */
+ gpios-states = <0x1>;
+- states = <1100000 0>, <1300000 1>;
++ states = <1108475 0>, <1308475 1>;
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From cdbd1d96f36da8b2b1baa2b550042a41d7b95944 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 14:58:37 +0100
+Subject: ARM: exynos: clear L310_AUX_CTRL_FULL_LINE_ZERO in default
+ l2c_aux_val
+
+From: Guillaume Tucker <guillaume.tucker@collabora.com>
+
+[ Upstream commit 5b17a04addc29201dc142c8d2c077eb7745d2e35 ]
+
+This "alert" error message can be seen on exynos4412-odroidx2:
+
+ L2C: platform modifies aux control register: 0x02070000 -> 0x3e470001
+ L2C: platform provided aux values permit register corruption.
+
+Followed by this plain error message:
+
+ L2C-310: enabling full line of zeros but not enabled in Cortex-A9
+
+To fix it, don't set the L310_AUX_CTRL_FULL_LINE_ZERO flag (bit 0) in
+the default value of l2c_aux_val. It may instead be enabled when
+applicable by the logic in l2c310_enable() if the attribute
+"arm,full-line-zero-disable" was set in the device tree.
+
+The initial commit that introduced this default value was in v2.6.38
+commit 1cf0eb799759 ("ARM: S5PV310: Add L2 cache init function in
+cpu.c").
+
+However, the code to set the L310_AUX_CTRL_FULL_LINE_ZERO flag and
+manage that feature was added much later and the default value was not
+updated then. So this seems to have been a subtle oversight
+especially since enabling it only in the cache and not in the A9 core
+doesn't actually prevent the platform from running. According to the
+TRM, the opposite would be a real issue, if the feature was enabled in
+the A9 core but not in the cache controller.
+
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Signed-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-exynos/exynos.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-exynos/exynos.c b/arch/arm/mach-exynos/exynos.c
+index 7a8d1555db404..36c37444485a8 100644
+--- a/arch/arm/mach-exynos/exynos.c
++++ b/arch/arm/mach-exynos/exynos.c
+@@ -193,7 +193,7 @@ static void __init exynos_dt_fixup(void)
+ }
+
+ DT_MACHINE_START(EXYNOS_DT, "Samsung Exynos (Flattened Device Tree)")
+- .l2c_aux_val = 0x3c400001,
++ .l2c_aux_val = 0x3c400000,
+ .l2c_aux_mask = 0xc20fffff,
+ .smp = smp_ops(exynos_smp_ops),
+ .map_io = exynos_init_io,
+--
+2.25.1
+
--- /dev/null
+From 2c4fa762bd8ace0b2155b42c224509d056e48635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 12:02:18 +0200
+Subject: ARM: exynos: MCPM: Restore big.LITTLE cpuidle support
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ea9dd8f61c8a890843f68e8dc0062ce78365aab8 ]
+
+Call exynos_cpu_power_up(cpunr) unconditionally. This is needed by the
+big.LITTLE cpuidle driver and has no side-effects on other code paths.
+
+The additional soft-reset call during little core power up has been added
+to properly boot all cores on the Exynos5422-based boards with secure
+firmware (like Odroid XU3/XU4 family). This however broke big.LITTLE
+CPUidle driver, which worked only on boards without secure firmware (like
+Peach-Pit/Pi Chromebooks). Apply the workaround only when board is
+running under secure firmware.
+
+Fixes: 833b5794e330 ("ARM: EXYNOS: reset Little cores when cpu is up")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-exynos/mcpm-exynos.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-exynos/mcpm-exynos.c b/arch/arm/mach-exynos/mcpm-exynos.c
+index 9a681b421ae11..cd861c57d5adf 100644
+--- a/arch/arm/mach-exynos/mcpm-exynos.c
++++ b/arch/arm/mach-exynos/mcpm-exynos.c
+@@ -26,6 +26,7 @@
+ #define EXYNOS5420_USE_L2_COMMON_UP_STATE BIT(30)
+
+ static void __iomem *ns_sram_base_addr __ro_after_init;
++static bool secure_firmware __ro_after_init;
+
+ /*
+ * The common v7_exit_coherency_flush API could not be used because of the
+@@ -58,15 +59,16 @@ static void __iomem *ns_sram_base_addr __ro_after_init;
+ static int exynos_cpu_powerup(unsigned int cpu, unsigned int cluster)
+ {
+ unsigned int cpunr = cpu + (cluster * EXYNOS5420_CPUS_PER_CLUSTER);
++ bool state;
+
+ pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
+ if (cpu >= EXYNOS5420_CPUS_PER_CLUSTER ||
+ cluster >= EXYNOS5420_NR_CLUSTERS)
+ return -EINVAL;
+
+- if (!exynos_cpu_power_state(cpunr)) {
+- exynos_cpu_power_up(cpunr);
+-
++ state = exynos_cpu_power_state(cpunr);
++ exynos_cpu_power_up(cpunr);
++ if (!state && secure_firmware) {
+ /*
+ * This assumes the cluster number of the big cores(Cortex A15)
+ * is 0 and the Little cores(Cortex A7) is 1.
+@@ -258,6 +260,8 @@ static int __init exynos_mcpm_init(void)
+ return -ENOMEM;
+ }
+
++ secure_firmware = exynos_secure_firmware_available();
++
+ /*
+ * To increase the stability of KFC reset we need to program
+ * the PMU SPARE3 register
+--
+2.25.1
+
--- /dev/null
+From 6c5ad6ac105d481678e27055b3c2d99a3116456a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 21:45:51 +0800
+Subject: ARM: socfpga: PM: add missing put_device() call in
+ socfpga_setup_ocram_self_refresh()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 3ad7b4e8f89d6bcc9887ca701cf2745a6aedb1a0 ]
+
+if of_find_device_by_node() succeed, socfpga_setup_ocram_self_refresh
+doesn't have a corresponding put_device(). Thus add a jump target to
+fix the exception handling for this function implementation.
+
+Fixes: 44fd8c7d4005 ("ARM: socfpga: support suspend to ram")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-socfpga/pm.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c
+index 6ed887cf8dc9a..365c0428b21b6 100644
+--- a/arch/arm/mach-socfpga/pm.c
++++ b/arch/arm/mach-socfpga/pm.c
+@@ -49,14 +49,14 @@ static int socfpga_setup_ocram_self_refresh(void)
+ if (!ocram_pool) {
+ pr_warn("%s: ocram pool unavailable!\n", __func__);
+ ret = -ENODEV;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_base = gen_pool_alloc(ocram_pool, socfpga_sdram_self_refresh_sz);
+ if (!ocram_base) {
+ pr_warn("%s: unable to alloc ocram!\n", __func__);
+ ret = -ENOMEM;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base);
+@@ -67,7 +67,7 @@ static int socfpga_setup_ocram_self_refresh(void)
+ if (!suspend_ocram_base) {
+ pr_warn("%s: __arm_ioremap_exec failed!\n", __func__);
+ ret = -ENOMEM;
+- goto put_node;
++ goto put_device;
+ }
+
+ /* Copy the code that puts DDR in self refresh to ocram */
+@@ -81,6 +81,8 @@ static int socfpga_setup_ocram_self_refresh(void)
+ if (!socfpga_sdram_self_refresh_in_ocram)
+ ret = -EFAULT;
+
++put_device:
++ put_device(&pdev->dev);
+ put_node:
+ of_node_put(np);
+
+--
+2.25.1
+
--- /dev/null
+From 7ddbaa22c018ad6352b953c0b258ac78626aba87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2020 12:39:17 +0530
+Subject: arm64: dts: exynos: Fix silent hang after boot on Espresso
+
+From: Alim Akhtar <alim.akhtar@samsung.com>
+
+[ Upstream commit b072714bfc0e42c984b8fd6e069f3ca17de8137a ]
+
+Once regulators are disabled after kernel boot, on Espresso board silent
+hang observed because of LDO7 being disabled. LDO7 actually provide
+power to CPU cores and non-cpu blocks circuitries. Keep this regulator
+always-on to fix this hang.
+
+Fixes: 9589f7721e16 ("arm64: dts: Add S2MPS15 PMIC node on exynos7-espresso")
+Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+index 7af288fa9475f..a9412805c1d6a 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+@@ -157,6 +157,7 @@ ldo7_reg: LDO7 {
+ regulator-min-microvolt = <700000>;
+ regulator-max-microvolt = <1150000>;
+ regulator-enable-ramp-delay = <125>;
++ regulator-always-on;
+ };
+
+ ldo8_reg: LDO8 {
+--
+2.25.1
+
--- /dev/null
+From 00c263785751a783430b9df945f0748783d86917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 08:33:06 +0200
+Subject: arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT
+ binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
+
+[ Upstream commit bbe28fc3cbabbef781bcdf847615d52ce2e26e42 ]
+
+hi3660-hikey960.dts:
+ Define a 'ports' node for 'adv7533: adv7533@39' and the
+ 'adi,dsi-lanes' property to make it compliant with the adi,adv7533 DT
+ binding.
+
+ This fills the requirements to meet the binding requirements,
+ remote endpoints are not defined.
+
+hi6220-hikey.dts:
+ Change property name s/pd-gpio/pd-gpios, gpio properties should be
+ plural. This is just a cosmetic change.
+
+Signed-off-by: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts | 11 +++++++++++
+ arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 2 +-
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
+index e035cf195b19a..8c4bfbaf3a806 100644
+--- a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
++++ b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
+@@ -530,6 +530,17 @@ adv7533: adv7533@39 {
+ status = "ok";
+ compatible = "adi,adv7533";
+ reg = <0x39>;
++ adi,dsi-lanes = <4>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ port@0 {
++ reg = <0>;
++ };
++ port@1 {
++ reg = <1>;
++ };
++ };
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+index c14205cd6bf5c..3e47150c05ec2 100644
+--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
++++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+@@ -516,7 +516,7 @@ adv7533: adv7533@39 {
+ reg = <0x39>;
+ interrupt-parent = <&gpio1>;
+ interrupts = <1 2>;
+- pd-gpio = <&gpio0 4 0>;
++ pd-gpios = <&gpio0 4 0>;
+ adi,dsi-lanes = <4>;
+ #sound-dai-cells = <0>;
+
+--
+2.25.1
+
--- /dev/null
+From 4d71d843a734664484ef17df0f82d01c1837380a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 01:59:50 +0000
+Subject: arm64: dts: meson: fix mmc0 tuning error on Khadas VIM3
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit f1bb924e8f5b50752a80fa5b48c43003680a7b64 ]
+
+Similar to other G12B devices using the W400 dtsi, I see reports of mmc0
+tuning errors on VIM3 after a few hours uptime:
+
+[12483.917391] mmc0: tuning execution failed: -5
+[30535.551221] mmc0: tuning execution failed: -5
+[35359.953671] mmc0: tuning execution failed: -5
+[35561.875332] mmc0: tuning execution failed: -5
+[61733.348709] mmc0: tuning execution failed: -5
+
+I do not see the same on VIM3L, so remove sd-uhs-sdr50 from the common dtsi
+to silence the error, then (re)add it to the VIM3L dts.
+
+Fixes: 4f26cc1c96c9 ("arm64: dts: khadas-vim3: move common nodes into meson-khadas-vim3.dtsi")
+Fixes: 700ab8d83927 ("arm64: dts: khadas-vim3: add support for the SM1 based VIM3L")
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20200721015950.11816-1-christianshewitt@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi | 1 -
+ arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts | 4 ++++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi
+index 1ef1e3672b967..ff5ba85b7562e 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi
+@@ -270,7 +270,6 @@ &sd_emmc_a {
+
+ bus-width = <4>;
+ cap-sd-highspeed;
+- sd-uhs-sdr50;
+ max-frequency = <100000000>;
+
+ non-removable;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
+index dbbf29a0dbf6d..026b21708b078 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
+@@ -88,6 +88,10 @@ &pcie {
+ status = "okay";
+ };
+
++&sd_emmc_a {
++ sd-uhs-sdr50;
++};
++
+ &usb {
+ phys = <&usb2_phy0>, <&usb2_phy1>;
+ phy-names = "usb2-phy0", "usb2-phy1";
+--
+2.25.1
+
--- /dev/null
+From 18225132907e834a08e93bac3bbe0bad330495fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 01:39:52 +0000
+Subject: arm64: dts: meson: misc fixups for w400 dtsi
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit 2fa17dd09533d5d83201be3229a28c1010a8ea3e ]
+
+Current devices using the W400 dtsi show mmc tuning errors:
+
+[12483.917391] mmc0: tuning execution failed: -5
+[30535.551221] mmc0: tuning execution failed: -5
+[35359.953671] mmc0: tuning execution failed: -5
+[35561.875332] mmc0: tuning execution failed: -5
+[61733.348709] mmc0: tuning execution failed: -5
+
+Removing "sd-uhs-sdr50" from the SDIO node prevents this. We also add
+keep-power-in-suspend to the SDIO node and fix an indentation.
+
+Fixes: 3cb74db9b256 ("arm64: dts: meson: convert ugoos-am6 to common w400 dtsi")
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20200721013952.11635-1-christianshewitt@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
+index 98b70d216a6f3..2802ddbb83ac7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
+@@ -336,9 +336,11 @@ &sd_emmc_a {
+
+ bus-width = <4>;
+ cap-sd-highspeed;
+- sd-uhs-sdr50;
+ max-frequency = <100000000>;
+
++ /* WiFi firmware requires power to be kept while in suspend */
++ keep-power-in-suspend;
++
+ non-removable;
+ disable-wp;
+
+@@ -398,7 +400,7 @@ bluetooth {
+ shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
+ max-speed = <2000000>;
+ clocks = <&wifi32k>;
+- clock-names = "lpo";
++ clock-names = "lpo";
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 04b256d06f66b0b5f8a2459233b161b543960b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 20:59:14 +0200
+Subject: arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 1b6a1a162defe649c5599d661b58ac64bb6f31b6 ]
+
+msm8916-pins.dtsi specifies "bias-pull-none" for most of the audio
+pin configurations. This was likely copied from the qcom kernel fork
+where the same property was used for these audio pins.
+
+However, "bias-pull-none" actually does not exist at all - not in
+mainline and not in downstream. I can only guess that the original
+intention was to configure "no pull", i.e. bias-disable.
+
+Change it to that instead.
+
+Fixes: 143bb9ad85b7 ("arm64: dts: qcom: add audio pinctrls")
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20200605185916.318494-2-stephan@gerhold.net
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+index e9c00367f7fd0..5785bf0a807ce 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+@@ -556,7 +556,7 @@ pinconf {
+ pins = "gpio63", "gpio64", "gpio65", "gpio66",
+ "gpio67", "gpio68";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+ cdc_pdm_lines_sus: pdm-lines-off {
+@@ -585,7 +585,7 @@ pinconf {
+ pins = "gpio113", "gpio114", "gpio115",
+ "gpio116";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+
+@@ -613,7 +613,7 @@ pinmux {
+ pinconf {
+ pins = "gpio110";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+
+@@ -639,7 +639,7 @@ pinmux {
+ pinconf {
+ pins = "gpio116";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+ ext_mclk_tlmm_lines_sus: mclk-lines-off {
+@@ -667,7 +667,7 @@ pinconf {
+ pins = "gpio112", "gpio117", "gpio118",
+ "gpio119";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+ ext_sec_tlmm_lines_sus: tlmm-lines-off {
+--
+2.25.1
+
--- /dev/null
+From 350ea98ddf2901cf2912f93c6cece15320fb81be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 21:03:54 +0900
+Subject: arm64: dts: renesas: Fix SD Card/eMMC interface device node names
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit a6cb262af1e1adfa6287cb43f09021ee42beb21c ]
+
+Fix the device node names as "mmc@".
+
+Fixes: 663386c3e1aa ("arm64: dts: renesas: r8a774a1: Add SDHI nodes")
+Fixes: 9b33e3001b67 ("arm64: dts: renesas: Initial r8a774b1 SoC device tree")
+Fixes: 77223211f44d ("arm64: dts: renesas: r8a774c0: Add SDHI nodes")
+Fixes: d9d67010e0c6 ("arm64: dts: r8a7795: Add SDHI support to dtsi")
+Fixes: a513cf1e6457 ("arm64: dts: r8a7796: add SDHI nodes")
+Fixes: 111cc9ace2b5 ("arm64: dts: renesas: r8a77961: Add SDHI nodes")
+Fixes: f51746ad7d1f ("arm64: dts: renesas: Add Renesas R8A77961 SoC support")
+Fixes: df863d6f95f5 ("arm64: dts: renesas: initial R8A77965 SoC device tree")
+Fixes: 9aa3558a02f0 ("arm64: dts: renesas: ebisu: Add and enable SDHI device nodes")
+Fixes: 83f18749c2f6 ("arm64: dts: renesas: r8a77995: Add SDHI (MMC) support")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1594382634-13714-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 8 ++++----
+ arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 8 ++++----
+ arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 6 +++---
+ arch/arm64/boot/dts/renesas/r8a77951.dtsi | 8 ++++----
+ arch/arm64/boot/dts/renesas/r8a77960.dtsi | 8 ++++----
+ arch/arm64/boot/dts/renesas/r8a77961.dtsi | 8 ++++----
+ arch/arm64/boot/dts/renesas/r8a77965.dtsi | 8 ++++----
+ arch/arm64/boot/dts/renesas/r8a77990.dtsi | 6 +++---
+ arch/arm64/boot/dts/renesas/r8a77995.dtsi | 2 +-
+ 9 files changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
+index a603d947970ec..16b059d7fd015 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
+@@ -2250,7 +2250,7 @@ usb2_phy1: usb-phy@ee0a0200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a774a1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -2262,7 +2262,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a774a1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -2274,7 +2274,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi2: sd@ee140000 {
++ sdhi2: mmc@ee140000 {
+ compatible = "renesas,sdhi-r8a774a1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee140000 0 0x2000>;
+@@ -2286,7 +2286,7 @@ sdhi2: sd@ee140000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a774a1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a774b1.dtsi b/arch/arm64/boot/dts/renesas/r8a774b1.dtsi
+index 1e51855c7cd38..6db8b6a4d191b 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774b1.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774b1.dtsi
+@@ -2108,7 +2108,7 @@ usb2_phy1: usb-phy@ee0a0200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a774b1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -2120,7 +2120,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a774b1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -2132,7 +2132,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi2: sd@ee140000 {
++ sdhi2: mmc@ee140000 {
+ compatible = "renesas,sdhi-r8a774b1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee140000 0 0x2000>;
+@@ -2144,7 +2144,7 @@ sdhi2: sd@ee140000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a774b1",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+index 5c72a7efbb035..42171190cce46 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+@@ -1618,7 +1618,7 @@ usb2_phy0: usb-phy@ee080200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a774c0",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -1630,7 +1630,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a774c0",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -1642,7 +1642,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a774c0",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a77951.dtsi b/arch/arm64/boot/dts/renesas/r8a77951.dtsi
+index 61d67d9714ab9..9beb8e76d9235 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77951.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77951.dtsi
+@@ -2590,7 +2590,7 @@ usb2_phy3: usb-phy@ee0e0200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a7795",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -2603,7 +2603,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a7795",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -2616,7 +2616,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi2: sd@ee140000 {
++ sdhi2: mmc@ee140000 {
+ compatible = "renesas,sdhi-r8a7795",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee140000 0 0x2000>;
+@@ -2629,7 +2629,7 @@ sdhi2: sd@ee140000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a7795",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a77960.dtsi b/arch/arm64/boot/dts/renesas/r8a77960.dtsi
+index 33bf62acffbb7..4dfb7f0767871 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77960.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77960.dtsi
+@@ -2394,7 +2394,7 @@ usb2_phy1: usb-phy@ee0a0200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a7796",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -2407,7 +2407,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a7796",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -2420,7 +2420,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi2: sd@ee140000 {
++ sdhi2: mmc@ee140000 {
+ compatible = "renesas,sdhi-r8a7796",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee140000 0 0x2000>;
+@@ -2433,7 +2433,7 @@ sdhi2: sd@ee140000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a7796",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a77961.dtsi b/arch/arm64/boot/dts/renesas/r8a77961.dtsi
+index 760e738b75b3d..eabb0e635cd4c 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77961.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77961.dtsi
+@@ -1257,7 +1257,7 @@ usb2_phy1: usb-phy@ee0a0200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a77961",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -1269,7 +1269,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a77961",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -1281,7 +1281,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi2: sd@ee140000 {
++ sdhi2: mmc@ee140000 {
+ compatible = "renesas,sdhi-r8a77961",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee140000 0 0x2000>;
+@@ -1293,7 +1293,7 @@ sdhi2: sd@ee140000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a77961",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+index 6f7ab39fd2824..fe4dc12e2bdfa 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+@@ -2120,7 +2120,7 @@ usb2_phy1: usb-phy@ee0a0200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a77965",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -2133,7 +2133,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a77965",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -2146,7 +2146,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi2: sd@ee140000 {
++ sdhi2: mmc@ee140000 {
+ compatible = "renesas,sdhi-r8a77965",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee140000 0 0x2000>;
+@@ -2159,7 +2159,7 @@ sdhi2: sd@ee140000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a77965",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+index cd11f24744d4a..1991bdc36792f 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+@@ -1595,7 +1595,7 @@ usb2_phy0: usb-phy@ee080200 {
+ status = "disabled";
+ };
+
+- sdhi0: sd@ee100000 {
++ sdhi0: mmc@ee100000 {
+ compatible = "renesas,sdhi-r8a77990",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee100000 0 0x2000>;
+@@ -1608,7 +1608,7 @@ sdhi0: sd@ee100000 {
+ status = "disabled";
+ };
+
+- sdhi1: sd@ee120000 {
++ sdhi1: mmc@ee120000 {
+ compatible = "renesas,sdhi-r8a77990",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee120000 0 0x2000>;
+@@ -1621,7 +1621,7 @@ sdhi1: sd@ee120000 {
+ status = "disabled";
+ };
+
+- sdhi3: sd@ee160000 {
++ sdhi3: mmc@ee160000 {
+ compatible = "renesas,sdhi-r8a77990",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee160000 0 0x2000>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a77995.dtsi b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
+index e5617ec0f49cb..2c2272f5f5b52 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77995.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
+@@ -916,7 +916,7 @@ usb2_phy0: usb-phy@ee080200 {
+ status = "disabled";
+ };
+
+- sdhi2: sd@ee140000 {
++ sdhi2: mmc@ee140000 {
+ compatible = "renesas,sdhi-r8a77995",
+ "renesas,rcar-gen3-sdhi";
+ reg = <0 0xee140000 0 0x2000>;
+--
+2.25.1
+
--- /dev/null
+From f3039ef1e8780b3d5013ae60ec6936021d073fd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jun 2020 23:29:09 +0200
+Subject: arm64: dts: rockchip: fix rk3368-lion gmac reset gpio
+
+From: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
+
+[ Upstream commit 2300e6dab473e93181cf76e4fe6671aa3d24c57b ]
+
+The lion gmac node currently uses opposite active-values for the
+gmac phy reset pin. The gpio-declaration uses active-high while the
+separate snps,reset-active-low property marks the pin as active low.
+
+While on the kernel side this works ok, other DT users may get
+confused - as seen with uboot right now.
+
+So bring this in line and make both properties match, similar to the
+other Rockchip board.
+
+Fixes: d99a02bcfa81 ("arm64: dts: rockchip: add RK3368-uQ7 (Lion) SoM")
+Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
+Link: https://lore.kernel.org/r/20200607212909.920575-1-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+index e17311e090826..216aafd90e7f1 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+@@ -156,7 +156,7 @@ &gmac {
+ pinctrl-0 = <&rgmii_pins>;
+ snps,reset-active-low;
+ snps,reset-delays-us = <0 10000 50000>;
+- snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_HIGH>;
++ snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_LOW>;
+ tx_delay = <0x10>;
+ rx_delay = <0x10>;
+ status = "okay";
+--
+2.25.1
+
--- /dev/null
+From a74e3a6a9e55b19845515e071f752c8768f84b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 15:28:36 +0200
+Subject: arm64: dts: rockchip: fix rk3399-puma gmac reset gpio
+
+From: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
+
+[ Upstream commit 8a445086f8af0b7b9bd8d1901d6f306bb154f70d ]
+
+The puma gmac node currently uses opposite active-values for the
+gmac phy reset pin. The gpio-declaration uses active-high while the
+separate snps,reset-active-low property marks the pin as active low.
+
+While on the kernel side this works ok, other DT users may get
+confused - as seen with uboot right now.
+
+So bring this in line and make both properties match, similar to the
+other Rockchip board.
+
+Fixes: 2c66fc34e945 ("arm64: dts: rockchip: add RK3399-Q7 (Puma) SoM")
+Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
+Link: https://lore.kernel.org/r/20200603132836.362519-1-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+index 063f59a420b65..72c06abd27ea7 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+@@ -157,7 +157,7 @@ &gmac {
+ phy-mode = "rgmii";
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_HIGH>;
++ snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_LOW>;
+ snps,reset-active-low;
+ snps,reset-delays-us = <0 10000 50000>;
+ tx_delay = <0x10>;
+--
+2.25.1
+
--- /dev/null
+From 516aa5d8c46b747fc460fd0ca54a98b8e1141481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2020 11:12:39 +0200
+Subject: arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio
+
+From: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
+
+[ Upstream commit 7a7184f6cfa9279f1a1c10a1845d247d7fad54ff ]
+
+The puma vcc5v0_host regulator node currently uses opposite active-values
+for the enable pin. The gpio-declaration uses active-high while the
+separate enable-active-low property marks the pin as active low.
+
+While on the kernel side this works ok, other DT users may get
+confused - as seen with uboot right now.
+
+So bring this in line and make both properties match, similar to the
+gmac fix.
+
+Fixes: 2c66fc34e945 ("arm64: dts: rockchip: add RK3399-Q7 (Puma) SoM")
+Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
+Link: https://lore.kernel.org/r/20200604091239.424318-1-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+index 07694b196fdbe..063f59a420b65 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+@@ -101,7 +101,7 @@ vcc3v3_sys: vcc3v3-sys {
+
+ vcc5v0_host: vcc5v0-host-regulator {
+ compatible = "regulator-fixed";
+- gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>;
+ enable-active-low;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_host_en>;
+--
+2.25.1
+
--- /dev/null
+From ba380c396e12752c97d0b914e3981dc45aa18762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 21:48:42 +0200
+Subject: arm64: dts: sun50i-pinephone: dldo4 must not be >= 1.8V
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit 86be5c789690eb08656b08c072c50a7b02bf41f1 ]
+
+Some outputs from the RTL8723CS are connected to the PL port (BT_WAKE_AP),
+which runs at 1.8V. When BT_WAKE_AP is high, the PL pin this signal is
+connected to is overdriven, and the whole PL port's voltage rises
+somewhat. This results in changing voltage on the R_PWM pin (PL10),
+which is the cause for backlight flickering very noticeably when typing
+on a Bluetooth keyboard, because backlight intensity is highly sensitive
+to the voltage of the R_PWM pin.
+
+Limit the maximum WiFi/BT I/O voltage to 1.8V to avoid overdriving
+the PL port pins via BT and WiFi IO port signals. WiFi and BT
+functionality is unaffected by this change.
+
+This completely stops the backlight flicker when using bluetooth.
+
+Fixes: 91f480d40942 ("arm64: dts: allwinner: Add initial support for Pine64 PinePhone")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Link: https://lore.kernel.org/r/20200703194842.111845-4-megous@megous.com
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
+index cefda145c3c9d..342733a20c337 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
+@@ -279,7 +279,7 @@ ®_dldo3 {
+
+ ®_dldo4 {
+ regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <3300000>;
++ regulator-max-microvolt = <1800000>;
+ regulator-name = "vcc-wifi-io";
+ };
+
+--
+2.25.1
+
--- /dev/null
+From e2163255e24cad6b44d9b39bd97973294245fd8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 13:05:33 -0500
+Subject: ASoC: core: use less strict tests for dailink capabilities
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 4f8721542f7b75954bfad98c51aa59d683d35b50 ]
+
+Previous updates to set dailink capabilities and check dailink
+capabilities were based on a flawed assumption that all dais support
+the same capabilities as the dailink. This is true for TDM
+configurations but existing configurations use an amplifier and a
+capture device on the same dailink, and the tests would prevent the
+card from probing.
+
+This patch modifies the snd_soc_dai_link_set_capabilities()
+helper so that the dpcm_playback (resp. dpcm_capture) dailink
+capabilities are set if at least one dai supports playback (resp. capture).
+
+Likewise the checks are modified so that an error is reported only
+when dpcm_playback (resp. dpcm_capture) is set but none of the CPU
+DAIs support playback (resp. capture).
+
+Fixes: 25612477d20b5 ('ASoC: soc-dai: set dai_link dpcm_ flags with a helper')
+Fixes: b73287f0b0745 ('ASoC: soc-pcm: dpcm: fix playback/capture checks')
+Suggested-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200723180533.220312-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dai.c | 16 +++++++++-------
+ sound/soc/soc-pcm.c | 42 ++++++++++++++++++++++++------------------
+ 2 files changed, 33 insertions(+), 25 deletions(-)
+
+diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
+index 457159975b01a..cecbbed2de9d5 100644
+--- a/sound/soc/soc-dai.c
++++ b/sound/soc/soc-dai.c
+@@ -400,28 +400,30 @@ void snd_soc_dai_link_set_capabilities(struct snd_soc_dai_link *dai_link)
+ struct snd_soc_dai_link_component *codec;
+ struct snd_soc_dai *dai;
+ bool supported[SNDRV_PCM_STREAM_LAST + 1];
++ bool supported_cpu;
++ bool supported_codec;
+ int direction;
+ int i;
+
+ for_each_pcm_streams(direction) {
+- supported[direction] = true;
++ supported_cpu = false;
++ supported_codec = false;
+
+ for_each_link_cpus(dai_link, i, cpu) {
+ dai = snd_soc_find_dai(cpu);
+- if (!dai || !snd_soc_dai_stream_valid(dai, direction)) {
+- supported[direction] = false;
++ if (dai && snd_soc_dai_stream_valid(dai, direction)) {
++ supported_cpu = true;
+ break;
+ }
+ }
+- if (!supported[direction])
+- continue;
+ for_each_link_codecs(dai_link, i, codec) {
+ dai = snd_soc_find_dai(codec);
+- if (!dai || !snd_soc_dai_stream_valid(dai, direction)) {
+- supported[direction] = false;
++ if (dai && snd_soc_dai_stream_valid(dai, direction)) {
++ supported_codec = true;
+ break;
+ }
+ }
++ supported[direction] = supported_cpu && supported_codec;
+ }
+
+ dai_link->dpcm_playback = supported[SNDRV_PCM_STREAM_PLAYBACK];
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index c517064f5391b..74baf1fce053f 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2802,30 +2802,36 @@ int soc_new_pcm(struct snd_soc_pcm_runtime *rtd, int num)
+ if (rtd->dai_link->dpcm_playback) {
+ stream = SNDRV_PCM_STREAM_PLAYBACK;
+
+- for_each_rtd_cpu_dais(rtd, i, cpu_dai)
+- if (!snd_soc_dai_stream_valid(cpu_dai,
+- stream)) {
+- dev_err(rtd->card->dev,
+- "CPU DAI %s for rtd %s does not support playback\n",
+- cpu_dai->name,
+- rtd->dai_link->stream_name);
+- return -EINVAL;
++ for_each_rtd_cpu_dais(rtd, i, cpu_dai) {
++ if (snd_soc_dai_stream_valid(cpu_dai, stream)) {
++ playback = 1;
++ break;
+ }
+- playback = 1;
++ }
++
++ if (!playback) {
++ dev_err(rtd->card->dev,
++ "No CPU DAIs support playback for stream %s\n",
++ rtd->dai_link->stream_name);
++ return -EINVAL;
++ }
+ }
+ if (rtd->dai_link->dpcm_capture) {
+ stream = SNDRV_PCM_STREAM_CAPTURE;
+
+- for_each_rtd_cpu_dais(rtd, i, cpu_dai)
+- if (!snd_soc_dai_stream_valid(cpu_dai,
+- stream)) {
+- dev_err(rtd->card->dev,
+- "CPU DAI %s for rtd %s does not support capture\n",
+- cpu_dai->name,
+- rtd->dai_link->stream_name);
+- return -EINVAL;
++ for_each_rtd_cpu_dais(rtd, i, cpu_dai) {
++ if (snd_soc_dai_stream_valid(cpu_dai, stream)) {
++ capture = 1;
++ break;
+ }
+- capture = 1;
++ }
++
++ if (!capture) {
++ dev_err(rtd->card->dev,
++ "No CPU DAIs support capture for stream %s\n",
++ rtd->dai_link->stream_name);
++ return -EINVAL;
++ }
+ }
+ } else {
+ /* Adapt stream for codec2codec links */
+--
+2.25.1
+
--- /dev/null
+From 2cc47f979ecc2895a1d338332316e8275c76919e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 17:03:31 +0800
+Subject: ASoC: fsl_easrc: Fix uninitialized scalar variable in
+ fsl_easrc_set_ctx_format
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 5748f4eb01a4df7a42024fe8bc7855f05febb7c5 ]
+
+The "ret" in fsl_easrc_set_ctx_format is not initialized, then
+the unknown value maybe returned by this function.
+
+Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Link: https://lore.kernel.org/r/1592816611-16297-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_easrc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/fsl_easrc.c b/sound/soc/fsl/fsl_easrc.c
+index c6b5eb2d2af79..fff1f02dadfee 100644
+--- a/sound/soc/fsl/fsl_easrc.c
++++ b/sound/soc/fsl/fsl_easrc.c
+@@ -1133,7 +1133,7 @@ int fsl_easrc_set_ctx_format(struct fsl_asrc_pair *ctx,
+ struct fsl_easrc_ctx_priv *ctx_priv = ctx->private;
+ struct fsl_easrc_data_fmt *in_fmt = &ctx_priv->in_params.fmt;
+ struct fsl_easrc_data_fmt *out_fmt = &ctx_priv->out_params.fmt;
+- int ret;
++ int ret = 0;
+
+ /* Get the bitfield values for input data format */
+ if (in_raw_format && out_raw_format) {
+--
+2.25.1
+
--- /dev/null
+From 17116f0333a7281eadf93884814af1ea6574b37c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 14:28:15 +0800
+Subject: ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 5aef1ff2397d021f93d874b57dff032fdfac73de ]
+
+The fifo_depth is 64 on i.MX8QM/i.MX8QXP, 128 on i.MX8MQ, 16 on
+i.MX7ULP.
+
+Original FSL_SAI_CR1_RFW_MASK value 0x1F is not suitable for
+these platform, the FIFO watermark mask should be updated
+according to the fifo_depth.
+
+Fixes: a860fac42097 ("ASoC: fsl_sai: Add support for imx7ulp/imx8mq")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Link: https://lore.kernel.org/r/1596176895-28724-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 5 +++--
+ sound/soc/fsl/fsl_sai.h | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 9d436b0c5718a..7031869a023a1 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -680,10 +680,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+- FSL_SAI_CR1_RFW_MASK,
++ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+ sai->soc_data->fifo_depth - FSL_SAI_MAXBURST_TX);
+ regmap_update_bits(sai->regmap, FSL_SAI_RCR1(ofs),
+- FSL_SAI_CR1_RFW_MASK, FSL_SAI_MAXBURST_RX - 1);
++ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
++ FSL_SAI_MAXBURST_RX - 1);
+
+ snd_soc_dai_init_dma_data(cpu_dai, &sai->dma_params_tx,
+ &sai->dma_params_rx);
+diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h
+index 76b15deea80c7..6aba7d28f5f34 100644
+--- a/sound/soc/fsl/fsl_sai.h
++++ b/sound/soc/fsl/fsl_sai.h
+@@ -94,7 +94,7 @@
+ #define FSL_SAI_CSR_FRDE BIT(0)
+
+ /* SAI Transmit and Receive Configuration 1 Register */
+-#define FSL_SAI_CR1_RFW_MASK 0x1f
++#define FSL_SAI_CR1_RFW_MASK(x) ((x) - 1)
+
+ /* SAI Transmit and Receive Configuration 2 Register */
+ #define FSL_SAI_CR2_SYNC BIT(30)
+--
+2.25.1
+
--- /dev/null
+From 517f321f3eff321faec70d7375d1da717a42aee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 13:19:50 +0300
+Subject: ASoC: hdac_hda: fix deadlock after PCM open error
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 06f07e2365378d51eddd0b5bf23506e1237662b0 ]
+
+Commit 5bd70440cb0a ("ASoC: soc-dai: revert all changes to DAI
+startup/shutdown sequence"), introduced a slight change of semantics
+to DAI startup/shutdown. If startup() returns an error, shutdown()
+is now called for the DAI.
+
+This causes a deadlock in hdac_hda which issues a call to
+snd_hda_codec_pcm_put() in case open fails. Upon error, soc_pcm_open()
+will call shutdown(), and pcm_put() ends up getting called twice. Result
+is a deadlock on pcm->open_mutex, as snd_device_free() gets called from
+within snd_pcm_open(). Typical task backtrace looks like this:
+
+[ 334.244627] snd_pcm_dev_disconnect+0x49/0x340 [snd_pcm]
+[ 334.244634] __snd_device_disconnect.part.0+0x2c/0x50 [snd]
+[ 334.244640] __snd_device_free+0x7f/0xc0 [snd]
+[ 334.244650] snd_hda_codec_pcm_put+0x87/0x120 [snd_hda_codec]
+[ 334.244660] soc_pcm_open+0x6a0/0xbe0 [snd_soc_core]
+[ 334.244676] ? dpcm_add_paths.isra.0+0x491/0x590 [snd_soc_core]
+[ 334.244679] ? kfree+0x9a/0x230
+[ 334.244686] dpcm_be_dai_startup+0x255/0x300 [snd_soc_core]
+[ 334.244695] dpcm_fe_dai_open+0x20e/0xf30 [snd_soc_core]
+[ 334.244701] ? snd_pcm_hw_rule_muldivk+0x110/0x110 [snd_pcm]
+[ 334.244709] ? dpcm_be_dai_startup+0x300/0x300 [snd_soc_core]
+[ 334.244714] ? snd_pcm_attach_substream+0x3c4/0x540 [snd_pcm]
+[ 334.244719] snd_pcm_open_substream+0x69a/0xb60 [snd_pcm]
+[ 334.244729] ? snd_pcm_release_substream+0x30/0x30 [snd_pcm]
+[ 334.244732] ? __mutex_lock_slowpath+0x10/0x10
+[ 334.244736] snd_pcm_open+0x1b3/0x3c0 [snd_pcm]
+
+Fixes: 5bd70440cb0a ("ASoC: soc-dai: revert all changes to DAI startup/shutdown sequence")
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
+BugLink: https://github.com/thesofproject/linux/issues/2159
+Link: https://lore.kernel.org/r/20200717101950.3885187-3-kai.vehmanen@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hda.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
+index 473efe9ef998a..b0370bb10c142 100644
+--- a/sound/soc/codecs/hdac_hda.c
++++ b/sound/soc/codecs/hdac_hda.c
+@@ -289,7 +289,6 @@ static int hdac_hda_dai_open(struct snd_pcm_substream *substream,
+ struct hdac_hda_priv *hda_pvt;
+ struct hda_pcm_stream *hda_stream;
+ struct hda_pcm *pcm;
+- int ret;
+
+ hda_pvt = snd_soc_component_get_drvdata(component);
+ pcm = snd_soc_find_pcm_from_dai(hda_pvt, dai);
+@@ -300,11 +299,7 @@ static int hdac_hda_dai_open(struct snd_pcm_substream *substream,
+
+ hda_stream = &pcm->stream[substream->stream];
+
+- ret = hda_stream->ops.open(hda_stream, &hda_pvt->codec, substream);
+- if (ret < 0)
+- snd_hda_codec_pcm_put(pcm);
+-
+- return ret;
++ return hda_stream->ops.open(hda_stream, &hda_pvt->codec, substream);
+ }
+
+ static void hdac_hda_dai_close(struct snd_pcm_substream *substream,
+--
+2.25.1
+
--- /dev/null
+From c1e1d1800aac8e14728b1ed80bdfd6c678ef2349 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 14:13:02 -0500
+Subject: ASoC: Intel: Boards: cml_rt1011_rt5682: use statically define codec
+ config
+
+From: Fred Oh <fred.oh@linux.intel.com>
+
+[ Upstream commit 8a473c39ae54c27e694a131c34a739d0f8aa5300 ]
+
+When the cml_rt1011_rt5682_dailink[].codecs pointer is overridden by
+a quirk with a devm allocated structure and the probe is deferred,
+in the next probe we will see an use-after-free condition
+(verified with KASAN). This can be avoided by using statically allocated
+configurations - which simplifies the code quite a bit as well.
+
+KASAN issue fixed.
+[ 23.301373] cml_rt1011_rt5682 cml_rt1011_rt5682: sof_rt1011_quirk = f
+[ 23.301875] ==================================================================
+[ 23.302018] BUG: KASAN: use-after-free in snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
+[ 23.302178] Read of size 8 at addr ffff8881ec6acae0 by task kworker/0:2/105
+[ 23.302320] CPU: 0 PID: 105 Comm: kworker/0:2 Not tainted 5.7.0-rc7-test+ #3
+[ 23.302322] Hardware name: Google Helios/Helios, BIOS 01/21/2020
+[ 23.302329] Workqueue: events deferred_probe_work_func
+[ 23.302331] Call Trace:
+[ 23.302339] dump_stack+0x76/0xa0
+[ 23.302345] print_address_description.constprop.0.cold+0xd3/0x43e
+[ 23.302351] ? _raw_spin_lock_irqsave+0x7b/0xd0
+[ 23.302355] ? _raw_spin_trylock_bh+0xf0/0xf0
+[ 23.302362] ? snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
+[ 23.302365] __kasan_report.cold+0x37/0x86
+[ 23.302371] ? snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
+[ 23.302375] kasan_report+0x38/0x50
+[ 23.302382] snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
+[ 23.302389] platform_drv_probe+0x66/0xc0
+
+Fixes: 629ba12e9998 ("ASoC: Intel: boards: split woofer and tweeter support")
+Suggested-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Fred Oh <fred.oh@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20200625191308.3322-12-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/cml_rt1011_rt5682.c | 83 ++++++----------------
+ 1 file changed, 23 insertions(+), 60 deletions(-)
+
+diff --git a/sound/soc/intel/boards/cml_rt1011_rt5682.c b/sound/soc/intel/boards/cml_rt1011_rt5682.c
+index 6f89b50a8c8ff..23dd8c5fc1e74 100644
+--- a/sound/soc/intel/boards/cml_rt1011_rt5682.c
++++ b/sound/soc/intel/boards/cml_rt1011_rt5682.c
+@@ -34,7 +34,6 @@
+ #define SOF_RT1011_SPEAKER_WR BIT(1)
+ #define SOF_RT1011_SPEAKER_TL BIT(2)
+ #define SOF_RT1011_SPEAKER_TR BIT(3)
+-#define SPK_CH 4
+
+ /* Default: Woofer speakers */
+ static unsigned long sof_rt1011_quirk = SOF_RT1011_SPEAKER_WL |
+@@ -376,10 +375,17 @@ SND_SOC_DAILINK_DEF(ssp0_codec,
+
+ SND_SOC_DAILINK_DEF(ssp1_pin,
+ DAILINK_COMP_ARRAY(COMP_CPU("SSP1 Pin")));
+-SND_SOC_DAILINK_DEF(ssp1_codec,
++SND_SOC_DAILINK_DEF(ssp1_codec_2spk,
+ DAILINK_COMP_ARRAY(
+ /* WL */ COMP_CODEC("i2c-10EC1011:00", CML_RT1011_CODEC_DAI),
+ /* WR */ COMP_CODEC("i2c-10EC1011:01", CML_RT1011_CODEC_DAI)));
++SND_SOC_DAILINK_DEF(ssp1_codec_4spk,
++ DAILINK_COMP_ARRAY(
++ /* WL */ COMP_CODEC("i2c-10EC1011:00", CML_RT1011_CODEC_DAI),
++ /* WR */ COMP_CODEC("i2c-10EC1011:01", CML_RT1011_CODEC_DAI),
++ /* TL */ COMP_CODEC("i2c-10EC1011:02", CML_RT1011_CODEC_DAI),
++ /* TR */ COMP_CODEC("i2c-10EC1011:03", CML_RT1011_CODEC_DAI)));
++
+
+ SND_SOC_DAILINK_DEF(dmic_pin,
+ DAILINK_COMP_ARRAY(COMP_CPU("DMIC01 Pin")));
+@@ -475,7 +481,7 @@ static struct snd_soc_dai_link cml_rt1011_rt5682_dailink[] = {
+ .no_pcm = 1,
+ .init = cml_rt1011_spk_init,
+ .ops = &cml_rt1011_ops,
+- SND_SOC_DAILINK_REG(ssp1_pin, ssp1_codec, platform),
++ SND_SOC_DAILINK_REG(ssp1_pin, ssp1_codec_2spk, platform),
+ },
+ };
+
+@@ -488,6 +494,15 @@ static struct snd_soc_codec_conf rt1011_conf[] = {
+ .dlc = COMP_CODEC_CONF("i2c-10EC1011:01"),
+ .name_prefix = "WR",
+ },
++ /* single configuration structure for 2 and 4 channels */
++ {
++ .dlc = COMP_CODEC_CONF("i2c-10EC1011:02"),
++ .name_prefix = "TL",
++ },
++ {
++ .dlc = COMP_CODEC_CONF("i2c-10EC1011:03"),
++ .name_prefix = "TR",
++ },
+ };
+
+ /* Cometlake audio machine driver for RT1011 and RT5682 */
+@@ -510,8 +525,6 @@ static struct snd_soc_card snd_soc_card_cml = {
+
+ static int snd_cml_rt1011_probe(struct platform_device *pdev)
+ {
+- struct snd_soc_dai_link_component *rt1011_dais_components;
+- struct snd_soc_codec_conf *rt1011_dais_confs;
+ struct card_private *ctx;
+ struct snd_soc_acpi_mach *mach;
+ const char *platform_name;
+@@ -530,65 +543,15 @@ static int snd_cml_rt1011_probe(struct platform_device *pdev)
+
+ dev_info(&pdev->dev, "sof_rt1011_quirk = %lx\n", sof_rt1011_quirk);
+
++ /* when 4 speaker is available, update codec config */
+ if (sof_rt1011_quirk & (SOF_RT1011_SPEAKER_TL |
+ SOF_RT1011_SPEAKER_TR)) {
+- rt1011_dais_confs = devm_kzalloc(&pdev->dev,
+- sizeof(struct snd_soc_codec_conf) *
+- SPK_CH, GFP_KERNEL);
+-
+- if (!rt1011_dais_confs)
+- return -ENOMEM;
+-
+- rt1011_dais_components = devm_kzalloc(&pdev->dev,
+- sizeof(struct snd_soc_dai_link_component) *
+- SPK_CH, GFP_KERNEL);
+-
+- if (!rt1011_dais_components)
+- return -ENOMEM;
+-
+- for (i = 0; i < SPK_CH; i++) {
+- rt1011_dais_confs[i].dlc.name = devm_kasprintf(&pdev->dev,
+- GFP_KERNEL,
+- "i2c-10EC1011:0%d",
+- i);
+-
+- if (!rt1011_dais_confs[i].dlc.name)
+- return -ENOMEM;
+-
+- switch (i) {
+- case 0:
+- rt1011_dais_confs[i].name_prefix = "WL";
+- break;
+- case 1:
+- rt1011_dais_confs[i].name_prefix = "WR";
+- break;
+- case 2:
+- rt1011_dais_confs[i].name_prefix = "TL";
+- break;
+- case 3:
+- rt1011_dais_confs[i].name_prefix = "TR";
+- break;
+- default:
+- return -EINVAL;
+- }
+- rt1011_dais_components[i].name = devm_kasprintf(&pdev->dev,
+- GFP_KERNEL,
+- "i2c-10EC1011:0%d",
+- i);
+- if (!rt1011_dais_components[i].name)
+- return -ENOMEM;
+-
+- rt1011_dais_components[i].dai_name = CML_RT1011_CODEC_DAI;
+- }
+-
+- snd_soc_card_cml.codec_conf = rt1011_dais_confs;
+- snd_soc_card_cml.num_configs = SPK_CH;
+-
+ for (i = 0; i < ARRAY_SIZE(cml_rt1011_rt5682_dailink); i++) {
+ if (!strcmp(cml_rt1011_rt5682_dailink[i].codecs->dai_name,
+- CML_RT1011_CODEC_DAI)) {
+- cml_rt1011_rt5682_dailink[i].codecs = rt1011_dais_components;
+- cml_rt1011_rt5682_dailink[i].num_codecs = SPK_CH;
++ CML_RT1011_CODEC_DAI)) {
++ cml_rt1011_rt5682_dailink[i].codecs = ssp1_codec_4spk;
++ cml_rt1011_rt5682_dailink[i].num_codecs =
++ ARRAY_SIZE(ssp1_codec_4spk);
+ }
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From cd2b340effc8feece9ff90fe75cb91aa36368ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 14:12:55 -0500
+Subject: ASoC: Intel: bxt_rt298: add missing .owner field
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 88cee34b776f80d2da04afb990c2a28c36799c43 ]
+
+This field is required for ASoC cards. Not setting it will result in a
+module->name pointer being NULL and generate problems such as
+
+cat /proc/asound/modules
+ 0 (efault)
+
+Fixes: 76016322ec56 ('ASoC: Intel: Add Broxton-P machine driver')
+Reported-by: Jaroslav Kysela <perex@perex.cz>
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200625191308.3322-5-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bxt_rt298.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
+index 7a4decf341918..c84c60df17dbc 100644
+--- a/sound/soc/intel/boards/bxt_rt298.c
++++ b/sound/soc/intel/boards/bxt_rt298.c
+@@ -565,6 +565,7 @@ static int bxt_card_late_probe(struct snd_soc_card *card)
+ /* broxton audio machine driver for SPT + RT298S */
+ static struct snd_soc_card broxton_rt298 = {
+ .name = "broxton-rt298",
++ .owner = THIS_MODULE,
+ .dai_link = broxton_rt298_dais,
+ .num_links = ARRAY_SIZE(broxton_rt298_dais),
+ .controls = broxton_controls,
+@@ -580,6 +581,7 @@ static struct snd_soc_card broxton_rt298 = {
+
+ static struct snd_soc_card geminilake_rt298 = {
+ .name = "geminilake-rt298",
++ .owner = THIS_MODULE,
+ .dai_link = broxton_rt298_dais,
+ .num_links = ARRAY_SIZE(broxton_rt298_dais),
+ .controls = broxton_controls,
+--
+2.25.1
+
--- /dev/null
+From 511e5e164d5cc238210de37202134051730b5534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 14:12:53 -0500
+Subject: ASoC: Intel: cml_rt1011_rt5682: add missing .owner field
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 299120928897d6cb893c7165df7cd232d835e259 ]
+
+This field is required for ASoC cards. Not setting it will result in a
+module->name pointer being NULL and generate problems such as
+
+cat /proc/asound/modules
+ 0 (efault)
+
+Fixes: 17fe95d6df93 ('ASoC: Intel: boards: Add CML m/c using RT1011 and RT5682')
+Reported-by: Jaroslav Kysela <perex@perex.cz>
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200625191308.3322-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/cml_rt1011_rt5682.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/boards/cml_rt1011_rt5682.c b/sound/soc/intel/boards/cml_rt1011_rt5682.c
+index 68eff29daf8f8..6f89b50a8c8ff 100644
+--- a/sound/soc/intel/boards/cml_rt1011_rt5682.c
++++ b/sound/soc/intel/boards/cml_rt1011_rt5682.c
+@@ -493,6 +493,7 @@ static struct snd_soc_codec_conf rt1011_conf[] = {
+ /* Cometlake audio machine driver for RT1011 and RT5682 */
+ static struct snd_soc_card snd_soc_card_cml = {
+ .name = "cml_rt1011_rt5682",
++ .owner = THIS_MODULE,
+ .dai_link = cml_rt1011_rt5682_dailink,
+ .num_links = ARRAY_SIZE(cml_rt1011_rt5682_dailink),
+ .codec_conf = rt1011_conf,
+--
+2.25.1
+
--- /dev/null
+From 1b783d28c9b96bf3824e7b291b1f028afc84fe7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 14:12:54 -0500
+Subject: ASoC: Intel: sof_sdw: add missing .owner field
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit fb4b42f68972d6bc905c8b6e21a43a490dedfca7 ]
+
+This field is required for ASoC cards. Not setting it will result in a
+module->name pointer being NULL and generate problems such as
+
+cat /proc/asound/modules
+ 0 (efault)
+
+Fixes: 52db12d193d4 ('ASoC: Intel: boards: add sof_sdw machine driver')
+Reported-by: Jaroslav Kysela <perex@perex.cz>
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200625191308.3322-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index e1c1a8ba78e62..1bfd9613449e9 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -893,6 +893,7 @@ static const char sdw_card_long_name[] = "Intel Soundwire SOF";
+
+ static struct snd_soc_card card_sof_sdw = {
+ .name = "soundwire",
++ .owner = THIS_MODULE,
+ .late_probe = sof_sdw_hdmi_card_late_probe,
+ .codec_conf = codec_conf,
+ .num_configs = ARRAY_SIZE(codec_conf),
+--
+2.25.1
+
--- /dev/null
+From 3bb064d8b883fd28c3617bb2ed38562d73db5dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 17:44:55 +0200
+Subject: ASoC: meson: axg-tdm-formatters: fix sclk inversion
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 0d3f01dcdc234001f979a0af0b6b31cb9f25b6c1 ]
+
+After carefully checking, it appears that both tdmout and tdmin require the
+rising edge of the sclk they get to be synchronized with the frame sync
+event (which should be a rising edge of lrclk).
+
+TDMIN was improperly set before this patch. Remove the sclk_invert quirk
+which is no longer needed and fix the sclk phase.
+
+Fixes: 1a11d88f499c ("ASoC: meson: add tdm formatter base driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20200729154456.1983396-4-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdm-formatter.c | 11 ++++++-----
+ sound/soc/meson/axg-tdm-formatter.h | 1 -
+ sound/soc/meson/axg-tdmin.c | 2 --
+ sound/soc/meson/axg-tdmout.c | 3 ---
+ 4 files changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/meson/axg-tdm-formatter.c b/sound/soc/meson/axg-tdm-formatter.c
+index 358c8c0d861cd..f7e8e9da68a06 100644
+--- a/sound/soc/meson/axg-tdm-formatter.c
++++ b/sound/soc/meson/axg-tdm-formatter.c
+@@ -70,7 +70,7 @@ EXPORT_SYMBOL_GPL(axg_tdm_formatter_set_channel_masks);
+ static int axg_tdm_formatter_enable(struct axg_tdm_formatter *formatter)
+ {
+ struct axg_tdm_stream *ts = formatter->stream;
+- bool invert = formatter->drv->quirks->invert_sclk;
++ bool invert;
+ int ret;
+
+ /* Do nothing if the formatter is already enabled */
+@@ -96,11 +96,12 @@ static int axg_tdm_formatter_enable(struct axg_tdm_formatter *formatter)
+ return ret;
+
+ /*
+- * If sclk is inverted, invert it back and provide the inversion
+- * required by the formatter
++ * If sclk is inverted, it means the bit should latched on the
++ * rising edge which is what our HW expects. If not, we need to
++ * invert it before the formatter.
+ */
+- invert ^= axg_tdm_sclk_invert(ts->iface->fmt);
+- ret = clk_set_phase(formatter->sclk, invert ? 180 : 0);
++ invert = axg_tdm_sclk_invert(ts->iface->fmt);
++ ret = clk_set_phase(formatter->sclk, invert ? 0 : 180);
+ if (ret)
+ return ret;
+
+diff --git a/sound/soc/meson/axg-tdm-formatter.h b/sound/soc/meson/axg-tdm-formatter.h
+index 9ef98e955cb27..a1f0dcc0ff134 100644
+--- a/sound/soc/meson/axg-tdm-formatter.h
++++ b/sound/soc/meson/axg-tdm-formatter.h
+@@ -16,7 +16,6 @@ struct snd_kcontrol;
+
+ struct axg_tdm_formatter_hw {
+ unsigned int skew_offset;
+- bool invert_sclk;
+ };
+
+ struct axg_tdm_formatter_ops {
+diff --git a/sound/soc/meson/axg-tdmin.c b/sound/soc/meson/axg-tdmin.c
+index 3d002b4eb939e..88ed95ae886bb 100644
+--- a/sound/soc/meson/axg-tdmin.c
++++ b/sound/soc/meson/axg-tdmin.c
+@@ -228,7 +228,6 @@ static const struct axg_tdm_formatter_driver axg_tdmin_drv = {
+ .regmap_cfg = &axg_tdmin_regmap_cfg,
+ .ops = &axg_tdmin_ops,
+ .quirks = &(const struct axg_tdm_formatter_hw) {
+- .invert_sclk = false,
+ .skew_offset = 2,
+ },
+ };
+@@ -238,7 +237,6 @@ static const struct axg_tdm_formatter_driver g12a_tdmin_drv = {
+ .regmap_cfg = &axg_tdmin_regmap_cfg,
+ .ops = &axg_tdmin_ops,
+ .quirks = &(const struct axg_tdm_formatter_hw) {
+- .invert_sclk = false,
+ .skew_offset = 3,
+ },
+ };
+diff --git a/sound/soc/meson/axg-tdmout.c b/sound/soc/meson/axg-tdmout.c
+index 418ec314b37d4..3ceabddae629e 100644
+--- a/sound/soc/meson/axg-tdmout.c
++++ b/sound/soc/meson/axg-tdmout.c
+@@ -238,7 +238,6 @@ static const struct axg_tdm_formatter_driver axg_tdmout_drv = {
+ .regmap_cfg = &axg_tdmout_regmap_cfg,
+ .ops = &axg_tdmout_ops,
+ .quirks = &(const struct axg_tdm_formatter_hw) {
+- .invert_sclk = true,
+ .skew_offset = 1,
+ },
+ };
+@@ -248,7 +247,6 @@ static const struct axg_tdm_formatter_driver g12a_tdmout_drv = {
+ .regmap_cfg = &axg_tdmout_regmap_cfg,
+ .ops = &axg_tdmout_ops,
+ .quirks = &(const struct axg_tdm_formatter_hw) {
+- .invert_sclk = true,
+ .skew_offset = 2,
+ },
+ };
+@@ -309,7 +307,6 @@ static const struct axg_tdm_formatter_driver sm1_tdmout_drv = {
+ .regmap_cfg = &axg_tdmout_regmap_cfg,
+ .ops = &axg_tdmout_ops,
+ .quirks = &(const struct axg_tdm_formatter_hw) {
+- .invert_sclk = true,
+ .skew_offset = 2,
+ },
+ };
+--
+2.25.1
+
--- /dev/null
+From 3f47c770ea4a6dc2507ab9a3435755c66266ad1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 17:44:53 +0200
+Subject: ASoC: meson: axg-tdm-interface: fix link fmt setup
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 6878ba91ce84f7a07887a0615af70f969508839f ]
+
+The .set_fmt() callback of the axg tdm interface incorrectly
+test the content of SND_SOC_DAIFMT_MASTER_MASK as if it was a
+bitfield, which it is not.
+
+Implement the test correctly.
+
+Fixes: d60e4f1e4be5 ("ASoC: meson: add tdm interface driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20200729154456.1983396-2-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdm-interface.c | 26 +++++++++++++++++---------
+ 1 file changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index 6de27238e9dff..36df30915378c 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -119,18 +119,25 @@ static int axg_tdm_iface_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ {
+ struct axg_tdm_iface *iface = snd_soc_dai_get_drvdata(dai);
+
+- /* These modes are not supported */
+- if (fmt & (SND_SOC_DAIFMT_CBS_CFM | SND_SOC_DAIFMT_CBM_CFS)) {
++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++ case SND_SOC_DAIFMT_CBS_CFS:
++ if (!iface->mclk) {
++ dev_err(dai->dev, "cpu clock master: mclk missing\n");
++ return -ENODEV;
++ }
++ break;
++
++ case SND_SOC_DAIFMT_CBM_CFM:
++ break;
++
++ case SND_SOC_DAIFMT_CBS_CFM:
++ case SND_SOC_DAIFMT_CBM_CFS:
+ dev_err(dai->dev, "only CBS_CFS and CBM_CFM are supported\n");
++ /* Fall-through */
++ default:
+ return -EINVAL;
+ }
+
+- /* If the TDM interface is the clock master, it requires mclk */
+- if (!iface->mclk && (fmt & SND_SOC_DAIFMT_CBS_CFS)) {
+- dev_err(dai->dev, "cpu clock master: mclk missing\n");
+- return -ENODEV;
+- }
+-
+ iface->fmt = fmt;
+ return 0;
+ }
+@@ -319,7 +326,8 @@ static int axg_tdm_iface_hw_params(struct snd_pcm_substream *substream,
+ if (ret)
+ return ret;
+
+- if (iface->fmt & SND_SOC_DAIFMT_CBS_CFS) {
++ if ((iface->fmt & SND_SOC_DAIFMT_MASTER_MASK) ==
++ SND_SOC_DAIFMT_CBS_CFS) {
+ ret = axg_tdm_iface_set_sclk(dai, params);
+ if (ret)
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From 29d42efc9ff326d83c9cee8865ef148e801a26db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 17:44:54 +0200
+Subject: ASoC: meson: axg-tdmin: fix g12a skew
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 80a254394fcfe55450b0351da298ca7231889219 ]
+
+After carefully checking the result provided by the TDMIN on the g12a and
+sm1 SoC families, the TDMIN skew offset appears to be 3 instead of 2 on the
+axg.
+
+Fixes: f01bc67f58fd ("ASoC: meson: axg-tdm-formatter: rework quirks settings")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20200729154456.1983396-3-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdmin.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/soc/meson/axg-tdmin.c b/sound/soc/meson/axg-tdmin.c
+index 973d4c02ef8db..3d002b4eb939e 100644
+--- a/sound/soc/meson/axg-tdmin.c
++++ b/sound/soc/meson/axg-tdmin.c
+@@ -233,10 +233,26 @@ static const struct axg_tdm_formatter_driver axg_tdmin_drv = {
+ },
+ };
+
++static const struct axg_tdm_formatter_driver g12a_tdmin_drv = {
++ .component_drv = &axg_tdmin_component_drv,
++ .regmap_cfg = &axg_tdmin_regmap_cfg,
++ .ops = &axg_tdmin_ops,
++ .quirks = &(const struct axg_tdm_formatter_hw) {
++ .invert_sclk = false,
++ .skew_offset = 3,
++ },
++};
++
+ static const struct of_device_id axg_tdmin_of_match[] = {
+ {
+ .compatible = "amlogic,axg-tdmin",
+ .data = &axg_tdmin_drv,
++ }, {
++ .compatible = "amlogic,g12a-tdmin",
++ .data = &g12a_tdmin_drv,
++ }, {
++ .compatible = "amlogic,sm1-tdmin",
++ .data = &g12a_tdmin_drv,
+ }, {}
+ };
+ MODULE_DEVICE_TABLE(of, axg_tdmin_of_match);
+--
+2.25.1
+
--- /dev/null
+From d2fd5e91f58cdd5559eb8fb5f3ad3d6e66a43b24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 14:06:03 +0200
+Subject: ASoC: meson: cards: deal dpcm flag change
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit da3f23fde9d7b4a7e0ca9a9a096cec3104df1b82 ]
+
+Commit b73287f0b074 ("ASoC: soc-pcm: dpcm: fix playback/capture checks")
+changed the meaning of dpcm_playback/dpcm_capture and now requires the
+CPU DAI BE to aligned with those flags.
+
+This broke all Amlogic cards with uni-directional backends (All gx and
+most axg cards).
+
+While I'm still confused as to how this change is an improvement, those
+cards can't remain broken forever. Hopefully, next time an API change is
+done like that, all the users will be updated as part of the change, and
+not left to fend for themselves.
+
+Fixes: b73287f0b074 ("ASoC: soc-pcm: dpcm: fix playback/capture checks")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20200731120603.2243261-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-card.c | 18 ++++++++++--------
+ sound/soc/meson/gx-card.c | 18 +++++++++---------
+ sound/soc/meson/meson-card-utils.c | 4 ----
+ 3 files changed, 19 insertions(+), 21 deletions(-)
+
+diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c
+index 47f2d93224fea..33058518c3da4 100644
+--- a/sound/soc/meson/axg-card.c
++++ b/sound/soc/meson/axg-card.c
+@@ -327,20 +327,22 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np,
+ return ret;
+
+ if (axg_card_cpu_is_playback_fe(dai_link->cpus->of_node))
+- ret = meson_card_set_fe_link(card, dai_link, np, true);
++ return meson_card_set_fe_link(card, dai_link, np, true);
+ else if (axg_card_cpu_is_capture_fe(dai_link->cpus->of_node))
+- ret = meson_card_set_fe_link(card, dai_link, np, false);
+- else
+- ret = meson_card_set_be_link(card, dai_link, np);
++ return meson_card_set_fe_link(card, dai_link, np, false);
+
++
++ ret = meson_card_set_be_link(card, dai_link, np);
+ if (ret)
+ return ret;
+
+- if (axg_card_cpu_is_tdm_iface(dai_link->cpus->of_node))
+- ret = axg_card_parse_tdm(card, np, index);
+- else if (axg_card_cpu_is_codec(dai_link->cpus->of_node)) {
++ if (axg_card_cpu_is_codec(dai_link->cpus->of_node)) {
+ dai_link->params = &codec_params;
+- dai_link->no_pcm = 0; /* link is not a DPCM BE */
++ } else {
++ dai_link->no_pcm = 1;
++ snd_soc_dai_link_set_capabilities(dai_link);
++ if (axg_card_cpu_is_tdm_iface(dai_link->cpus->of_node))
++ ret = axg_card_parse_tdm(card, np, index);
+ }
+
+ return ret;
+diff --git a/sound/soc/meson/gx-card.c b/sound/soc/meson/gx-card.c
+index 4abf7efb7eacc..fdd2d5303b2a7 100644
+--- a/sound/soc/meson/gx-card.c
++++ b/sound/soc/meson/gx-card.c
+@@ -96,21 +96,21 @@ static int gx_card_add_link(struct snd_soc_card *card, struct device_node *np,
+ return ret;
+
+ if (gx_card_cpu_identify(dai_link->cpus, "FIFO"))
+- ret = meson_card_set_fe_link(card, dai_link, np, true);
+- else
+- ret = meson_card_set_be_link(card, dai_link, np);
++ return meson_card_set_fe_link(card, dai_link, np, true);
+
++ ret = meson_card_set_be_link(card, dai_link, np);
+ if (ret)
+ return ret;
+
+- /* Check if the cpu is the i2s encoder and parse i2s data */
+- if (gx_card_cpu_identify(dai_link->cpus, "I2S Encoder"))
+- ret = gx_card_parse_i2s(card, np, index);
+-
+ /* Or apply codec to codec params if necessary */
+- else if (gx_card_cpu_identify(dai_link->cpus, "CODEC CTRL")) {
++ if (gx_card_cpu_identify(dai_link->cpus, "CODEC CTRL")) {
+ dai_link->params = &codec_params;
+- dai_link->no_pcm = 0; /* link is not a DPCM BE */
++ } else {
++ dai_link->no_pcm = 1;
++ snd_soc_dai_link_set_capabilities(dai_link);
++ /* Check if the cpu is the i2s encoder and parse i2s data */
++ if (gx_card_cpu_identify(dai_link->cpus, "I2S Encoder"))
++ ret = gx_card_parse_i2s(card, np, index);
+ }
+
+ return ret;
+diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
+index 5a4a91c887347..c734131ff0d62 100644
+--- a/sound/soc/meson/meson-card-utils.c
++++ b/sound/soc/meson/meson-card-utils.c
+@@ -147,10 +147,6 @@ int meson_card_set_be_link(struct snd_soc_card *card,
+ struct device_node *np;
+ int ret, num_codecs;
+
+- link->no_pcm = 1;
+- link->dpcm_playback = 1;
+- link->dpcm_capture = 1;
+-
+ num_codecs = of_get_child_count(node);
+ if (!num_codecs) {
+ dev_err(card->dev, "be link %s has no codec\n",
+--
+2.25.1
+
--- /dev/null
+From 86da32dee40956808f3930c7a513fcb1a2a98266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 16:22:42 +0800
+Subject: ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit bd054ece7d9cdd88e900df6625e951a01d9f655e ]
+
+axg_card_add_tdm_loopback() misses to call kfree() in an error path. We
+can use devm_kasprintf() to fix the issue, also improve maintainability.
+So use it instead.
+
+Fixes: c84836d7f650 ("ASoC: meson: axg-card: use modern dai_link style")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20200717082242.130627-1-jingxiangfeng@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c
+index 89f7f64747cd0..47f2d93224fea 100644
+--- a/sound/soc/meson/axg-card.c
++++ b/sound/soc/meson/axg-card.c
+@@ -116,7 +116,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card,
+
+ lb = &card->dai_link[*index + 1];
+
+- lb->name = kasprintf(GFP_KERNEL, "%s-lb", pad->name);
++ lb->name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-lb", pad->name);
+ if (!lb->name)
+ return -ENOMEM;
+
+--
+2.25.1
+
--- /dev/null
+From e4c220fecc3e730eb350438582a1ec9d8effa6ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:07:14 +0100
+Subject: ASoC: soc-core: Fix regression causing sysfs entries to disappear
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 5c74c9d34aec1ac756de6979dd5580096aba8643 ]
+
+The allocation order of things in soc_new_pcm_runtime was changed to
+move the device_register before the allocation of the rtd structure.
+This was to allow the rtd allocation to be managed by devm. However
+currently the sysfs entries are added by device_register and their
+visibility depends on variables within the rtd structure, this causes
+the pmdown_time and dapm_widgets sysfs entries to be missing for all
+rtds.
+
+Correct this issue by manually calling device_add_groups after the
+appropriate information is available.
+
+Fixes: d918a37610b1 ("ASoC: soc-core: tidyup soc_new_pcm_runtime() alloc order")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20200730120715.637-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 2b8abf88ec603..f1d641cd48da9 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -446,7 +446,6 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
+
+ dev->parent = card->dev;
+ dev->release = soc_release_rtd_dev;
+- dev->groups = soc_dev_attr_groups;
+
+ dev_set_name(dev, "%s", dai_link->name);
+
+@@ -503,6 +502,10 @@ static struct snd_soc_pcm_runtime *soc_new_pcm_runtime(
+ /* see for_each_card_rtds */
+ list_add_tail(&rtd->list, &card->rtd_list);
+
++ ret = device_add_groups(dev, soc_dev_attr_groups);
++ if (ret < 0)
++ goto free_rtd;
++
+ return rtd;
+
+ free_rtd:
+--
+2.25.1
+
--- /dev/null
+From c43c6f1df888a1591b25f521821ec9b23ba5fb6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 14:12:52 -0500
+Subject: ASoC: SOF: nocodec: add missing .owner field
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 8753889e2720c1ef7ebf03370e384f5bf5ff4fab ]
+
+This field is required for ASoC cards. Not setting it will result in a
+module->name pointer being NULL and generate problems such as
+
+cat /proc/asound/modules
+ 0 (efault)
+
+Fixes: 8017b8fd37bf ('ASoC: SOF: Add Nocodec machine driver support')
+Reported-by: Jaroslav Kysela <perex@perex.cz>
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200625191308.3322-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/nocodec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/sof/nocodec.c b/sound/soc/sof/nocodec.c
+index d03b5be31255b..9e922df6a7101 100644
+--- a/sound/soc/sof/nocodec.c
++++ b/sound/soc/sof/nocodec.c
+@@ -14,6 +14,7 @@
+
+ static struct snd_soc_card sof_nocodec_card = {
+ .name = "nocodec", /* the sof- prefix is added by the core */
++ .owner = THIS_MODULE
+ };
+
+ static int sof_nocodec_bes_setup(struct device *dev,
+--
+2.25.1
+
--- /dev/null
+From 75f2d0ff1bbe35df623f99d63ea31e614a437565 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 13:12:02 -0500
+Subject: ASoC: tas2770: Fix reset gpio property name
+
+From: Dan Murphy <dmurphy@ti.com>
+
+[ Upstream commit 58b868f51d6e38146e44cb09fcd92b5fc35d83bc ]
+
+Fix the reset property name when allocating the GPIO descriptor.
+The gpiod_get_optional appends either the -gpio or -gpios suffix to the
+name.
+
+Fixes: 1a476abc723e6 ("tas2770: add tas2770 smart PA kernel driver")
+Signed-off-by: Dan Murphy <dmurphy@ti.com>
+Link: https://lore.kernel.org/r/20200720181202.31000-2-dmurphy@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2770.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c
+index 54c8135fe43c1..cf071121c8398 100644
+--- a/sound/soc/codecs/tas2770.c
++++ b/sound/soc/codecs/tas2770.c
+@@ -758,8 +758,7 @@ static int tas2770_i2c_probe(struct i2c_client *client,
+ }
+ }
+
+- tas2770->reset_gpio = devm_gpiod_get_optional(tas2770->dev,
+- "reset-gpio",
++ tas2770->reset_gpio = devm_gpiod_get_optional(tas2770->dev, "reset",
+ GPIOD_OUT_HIGH);
+ if (IS_ERR(tas2770->reset_gpio)) {
+ if (PTR_ERR(tas2770->reset_gpio) == -EPROBE_DEFER) {
+--
+2.25.1
+
--- /dev/null
+From ca8f0c31e647aaeb1db88145ed4158682a9551be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2020 10:59:11 -0700
+Subject: ath10k: Acquire tx_lock in tx error paths
+
+From: Evan Green <evgreen@chromium.org>
+
+[ Upstream commit a738e766e3ed92c4ee5ec967777276b5ce11dd2c ]
+
+ath10k_htt_tx_free_msdu_id() has a lockdep assertion that htt->tx_lock
+is held. Acquire the lock in a couple of error paths when calling that
+function to ensure this condition is met.
+
+Fixes: 6421969f248fd ("ath10k: refactor tx pending management")
+Fixes: e62ee5c381c59 ("ath10k: Add support for htt_data_tx_desc_64 descriptor")
+Signed-off-by: Evan Green <evgreen@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200604105901.1.I5b8b0c7ee0d3e51a73248975a9da61401b8f3900@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/htt_tx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
+index 4fd10ac3a9417..bbe869575855a 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
+@@ -1591,7 +1591,9 @@ static int ath10k_htt_tx_32(struct ath10k_htt *htt,
+ err_unmap_msdu:
+ dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ err_free_msdu_id:
++ spin_lock_bh(&htt->tx_lock);
+ ath10k_htt_tx_free_msdu_id(htt, msdu_id);
++ spin_unlock_bh(&htt->tx_lock);
+ err:
+ return res;
+ }
+@@ -1798,7 +1800,9 @@ static int ath10k_htt_tx_64(struct ath10k_htt *htt,
+ err_unmap_msdu:
+ dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ err_free_msdu_id:
++ spin_lock_bh(&htt->tx_lock);
+ ath10k_htt_tx_free_msdu_id(htt, msdu_id);
++ spin_unlock_bh(&htt->tx_lock);
+ err:
+ return res;
+ }
+--
+2.25.1
+
--- /dev/null
+From ace1b6b7719e18b0a5fb00fbb4a5f89cd9f49337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jul 2020 20:00:26 +0800
+Subject: bcache: fix super block seq numbers comparision in
+ register_cache_set()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 117f636ea695270fe492d0c0c9dfadc7a662af47 ]
+
+In register_cache_set(), c is pointer to struct cache_set, and ca is
+pointer to struct cache, if ca->sb.seq > c->sb.seq, it means this
+registering cache has up to date version and other members, the in-
+memory version and other members should be updated to the newer value.
+
+But current implementation makes a cache set only has a single cache
+device, so the above assumption works well except for a special case.
+The execption is when a cache device new created and both ca->sb.seq and
+c->sb.seq are 0, because the super block is never flushed out yet. In
+the location for the following if() check,
+2156 if (ca->sb.seq > c->sb.seq) {
+2157 c->sb.version = ca->sb.version;
+2158 memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16);
+2159 c->sb.flags = ca->sb.flags;
+2160 c->sb.seq = ca->sb.seq;
+2161 pr_debug("set version = %llu\n", c->sb.version);
+2162 }
+c->sb.version is not initialized yet and valued 0. When ca->sb.seq is 0,
+the if() check will fail (because both values are 0), and the cache set
+version, set_uuid, flags and seq won't be updated.
+
+The above problem is hiden for current code, because the bucket size is
+compatible among different super block version. And the next time when
+running cache set again, ca->sb.seq will be larger than 0 and cache set
+super block version will be updated properly.
+
+But if the large bucket feature is enabled, sb->bucket_size is the low
+16bits of the bucket size. For a power of 2 value, when the actual
+bucket size exceeds 16bit width, sb->bucket_size will always be 0. Then
+read_super_common() will fail because the if() check to
+is_power_of_2(sb->bucket_size) is false. This is how the long time
+hidden bug is triggered.
+
+This patch modifies the if() check to the following way,
+2156 if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) {
+Then cache set's version, set_uuid, flags and seq will always be updated
+corectly including for a new created cache device.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 2014016f9a60d..445bb84ee27f8 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2100,7 +2100,14 @@ static const char *register_cache_set(struct cache *ca)
+ sysfs_create_link(&c->kobj, &ca->kobj, buf))
+ goto err;
+
+- if (ca->sb.seq > c->sb.seq) {
++ /*
++ * A special case is both ca->sb.seq and c->sb.seq are 0,
++ * such condition happens on a new created cache device whose
++ * super block is never flushed yet. In this case c->sb.version
++ * and other members should be updated too, otherwise we will
++ * have a mistaken super block version in cache set.
++ */
++ if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) {
+ c->sb.version = ca->sb.version;
+ memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16);
+ c->sb.flags = ca->sb.flags;
+--
+2.25.1
+
--- /dev/null
+From ae09b288d3c52247d2b3be33db91f2625110e308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 13:07:42 -0400
+Subject: bdc: Fix bug causing crash after multiple disconnects
+
+From: Sasi Kumar <sasi.kumar@broadcom.com>
+
+[ Upstream commit a95bdfd22076497288868c028619bc5995f5cc7f ]
+
+Multiple connects/disconnects can cause a crash on the second
+disconnect. The driver had a problem where it would try to send
+endpoint commands after it was disconnected which is not allowed
+by the hardware. The fix is to only allow the endpoint commands
+when the endpoint is connected. This will also fix issues that
+showed up when using configfs to create gadgets.
+
+Signed-off-by: Sasi Kumar <sasi.kumar@broadcom.com>
+Signed-off-by: Al Cooper <alcooperx@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/bdc/bdc_core.c | 4 ++++
+ drivers/usb/gadget/udc/bdc/bdc_ep.c | 16 ++++++++++------
+ 2 files changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
+index 02a3a774670b1..5fde5a8b065c1 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
+@@ -282,6 +282,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit)
+ * in that case reinit is passed as 1
+ */
+ if (reinit) {
++ int i;
+ /* Enable interrupts */
+ temp = bdc_readl(bdc->regs, BDC_BDCSC);
+ temp |= BDC_GIE;
+@@ -291,6 +292,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit)
+ /* Initialize SRR to 0 */
+ memset(bdc->srr.sr_bds, 0,
+ NUM_SR_ENTRIES * sizeof(struct bdc_bd));
++ /* clear ep flags to avoid post disconnect stops/deconfigs */
++ for (i = 1; i < bdc->num_eps; ++i)
++ bdc->bdc_ep_array[i]->flags = 0;
+ } else {
+ /* One time initiaization only */
+ /* Enable status report function pointers */
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
+index d49c6dc1082dc..9ddc0b4e92c9c 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
+@@ -615,7 +615,6 @@ int bdc_ep_enable(struct bdc_ep *ep)
+ }
+ bdc_dbg_bd_list(bdc, ep);
+ /* only for ep0: config ep is called for ep0 from connect event */
+- ep->flags |= BDC_EP_ENABLED;
+ if (ep->ep_num == 1)
+ return ret;
+
+@@ -759,10 +758,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req)
+ __func__, ep->name, start_bdi, end_bdi);
+ dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n",
+ ep, (void *)ep->usb_ep.desc);
+- /* Stop the ep to see where the HW is ? */
+- ret = bdc_stop_ep(bdc, ep->ep_num);
+- /* if there is an issue with stopping ep, then no need to go further */
+- if (ret)
++ /* if still connected, stop the ep to see where the HW is ? */
++ if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) {
++ ret = bdc_stop_ep(bdc, ep->ep_num);
++ /* if there is an issue, then no need to go further */
++ if (ret)
++ return 0;
++ } else
+ return 0;
+
+ /*
+@@ -1911,7 +1913,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep)
+ __func__, ep->name, ep->flags);
+
+ if (!(ep->flags & BDC_EP_ENABLED)) {
+- dev_warn(bdc->dev, "%s is already disabled\n", ep->name);
++ if (bdc->gadget.speed != USB_SPEED_UNKNOWN)
++ dev_warn(bdc->dev, "%s is already disabled\n",
++ ep->name);
+ return 0;
+ }
+ spin_lock_irqsave(&bdc->lock, flags);
+--
+2.25.1
+
--- /dev/null
+From 51fde5d12102523006cf49a0bd7f820dd3f6e9ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 20:47:28 +0000
+Subject: blktrace: fix debugfs use after free
+
+From: Luis Chamberlain <mcgrof@kernel.org>
+
+[ Upstream commit bad8e64fb19d3a0de5e564d9a7271c31bd684369 ]
+
+On commit 6ac93117ab00 ("blktrace: use existing disk debugfs directory")
+merged on v4.12 Omar fixed the original blktrace code for request-based
+drivers (multiqueue). This however left in place a possible crash, if you
+happen to abuse blktrace while racing to remove / add a device.
+
+We used to use asynchronous removal of the request_queue, and with that
+the issue was easier to reproduce. Now that we have reverted to
+synchronous removal of the request_queue, the issue is still possible to
+reproduce, its however just a bit more difficult.
+
+We essentially run two instances of break-blktrace which add/remove
+a loop device, and setup a blktrace and just never tear the blktrace
+down. We do this twice in parallel. This is easily reproduced with the
+script run_0004.sh from break-blktrace [0].
+
+We can end up with two types of panics each reflecting where we
+race, one a failed blktrace setup:
+
+[ 252.426751] debugfs: Directory 'loop0' with parent 'block' already present!
+[ 252.432265] BUG: kernel NULL pointer dereference, address: 00000000000000a0
+[ 252.436592] #PF: supervisor write access in kernel mode
+[ 252.439822] #PF: error_code(0x0002) - not-present page
+[ 252.442967] PGD 0 P4D 0
+[ 252.444656] Oops: 0002 [#1] SMP NOPTI
+[ 252.446972] CPU: 10 PID: 1153 Comm: break-blktrace Tainted: G E 5.7.0-rc2-next-20200420+ #164
+[ 252.452673] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
+[ 252.456343] RIP: 0010:down_write+0x15/0x40
+[ 252.458146] Code: eb ca e8 ae 22 8d ff cc cc cc cc cc cc cc cc cc cc cc cc
+ cc cc 0f 1f 44 00 00 55 48 89 fd e8 52 db ff ff 31 c0 ba 01 00
+ 00 00 <f0> 48 0f b1 55 00 75 0f 48 8b 04 25 c0 8b 01 00 48 89
+ 45 08 5d
+[ 252.463638] RSP: 0018:ffffa626415abcc8 EFLAGS: 00010246
+[ 252.464950] RAX: 0000000000000000 RBX: ffff958c25f0f5c0 RCX: ffffff8100000000
+[ 252.466727] RDX: 0000000000000001 RSI: ffffff8100000000 RDI: 00000000000000a0
+[ 252.468482] RBP: 00000000000000a0 R08: 0000000000000000 R09: 0000000000000001
+[ 252.470014] R10: 0000000000000000 R11: ffff958d1f9227ff R12: 0000000000000000
+[ 252.471473] R13: ffff958c25ea5380 R14: ffffffff8cce15f1 R15: 00000000000000a0
+[ 252.473346] FS: 00007f2e69dee540(0000) GS:ffff958c2fc80000(0000) knlGS:0000000000000000
+[ 252.475225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 252.476267] CR2: 00000000000000a0 CR3: 0000000427d10004 CR4: 0000000000360ee0
+[ 252.477526] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 252.478776] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 252.479866] Call Trace:
+[ 252.480322] simple_recursive_removal+0x4e/0x2e0
+[ 252.481078] ? debugfs_remove+0x60/0x60
+[ 252.481725] ? relay_destroy_buf+0x77/0xb0
+[ 252.482662] debugfs_remove+0x40/0x60
+[ 252.483518] blk_remove_buf_file_callback+0x5/0x10
+[ 252.484328] relay_close_buf+0x2e/0x60
+[ 252.484930] relay_open+0x1ce/0x2c0
+[ 252.485520] do_blk_trace_setup+0x14f/0x2b0
+[ 252.486187] __blk_trace_setup+0x54/0xb0
+[ 252.486803] blk_trace_ioctl+0x90/0x140
+[ 252.487423] ? do_sys_openat2+0x1ab/0x2d0
+[ 252.488053] blkdev_ioctl+0x4d/0x260
+[ 252.488636] block_ioctl+0x39/0x40
+[ 252.489139] ksys_ioctl+0x87/0xc0
+[ 252.489675] __x64_sys_ioctl+0x16/0x20
+[ 252.490380] do_syscall_64+0x52/0x180
+[ 252.491032] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+And the other on the device removal:
+
+[ 128.528940] debugfs: Directory 'loop0' with parent 'block' already present!
+[ 128.615325] BUG: kernel NULL pointer dereference, address: 00000000000000a0
+[ 128.619537] #PF: supervisor write access in kernel mode
+[ 128.622700] #PF: error_code(0x0002) - not-present page
+[ 128.625842] PGD 0 P4D 0
+[ 128.627585] Oops: 0002 [#1] SMP NOPTI
+[ 128.629871] CPU: 12 PID: 544 Comm: break-blktrace Tainted: G E 5.7.0-rc2-next-20200420+ #164
+[ 128.635595] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
+[ 128.640471] RIP: 0010:down_write+0x15/0x40
+[ 128.643041] Code: eb ca e8 ae 22 8d ff cc cc cc cc cc cc cc cc cc cc cc cc
+ cc cc 0f 1f 44 00 00 55 48 89 fd e8 52 db ff ff 31 c0 ba 01 00
+ 00 00 <f0> 48 0f b1 55 00 75 0f 65 48 8b 04 25 c0 8b 01 00 48 89
+ 45 08 5d
+[ 128.650180] RSP: 0018:ffffa9c3c05ebd78 EFLAGS: 00010246
+[ 128.651820] RAX: 0000000000000000 RBX: ffff8ae9a6370240 RCX: ffffff8100000000
+[ 128.653942] RDX: 0000000000000001 RSI: ffffff8100000000 RDI: 00000000000000a0
+[ 128.655720] RBP: 00000000000000a0 R08: 0000000000000002 R09: ffff8ae9afd2d3d0
+[ 128.657400] R10: 0000000000000056 R11: 0000000000000000 R12: 0000000000000000
+[ 128.659099] R13: 0000000000000000 R14: 0000000000000003 R15: 00000000000000a0
+[ 128.660500] FS: 00007febfd995540(0000) GS:ffff8ae9afd00000(0000) knlGS:0000000000000000
+[ 128.662204] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 128.663426] CR2: 00000000000000a0 CR3: 0000000420042003 CR4: 0000000000360ee0
+[ 128.664776] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 128.666022] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 128.667282] Call Trace:
+[ 128.667801] simple_recursive_removal+0x4e/0x2e0
+[ 128.668663] ? debugfs_remove+0x60/0x60
+[ 128.669368] debugfs_remove+0x40/0x60
+[ 128.669985] blk_trace_free+0xd/0x50
+[ 128.670593] __blk_trace_remove+0x27/0x40
+[ 128.671274] blk_trace_shutdown+0x30/0x40
+[ 128.671935] blk_release_queue+0x95/0xf0
+[ 128.672589] kobject_put+0xa5/0x1b0
+[ 128.673188] disk_release+0xa2/0xc0
+[ 128.673786] device_release+0x28/0x80
+[ 128.674376] kobject_put+0xa5/0x1b0
+[ 128.674915] loop_remove+0x39/0x50 [loop]
+[ 128.675511] loop_control_ioctl+0x113/0x130 [loop]
+[ 128.676199] ksys_ioctl+0x87/0xc0
+[ 128.676708] __x64_sys_ioctl+0x16/0x20
+[ 128.677274] do_syscall_64+0x52/0x180
+[ 128.677823] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+The common theme here is:
+
+debugfs: Directory 'loop0' with parent 'block' already present
+
+This crash happens because of how blktrace uses the debugfs directory
+where it places its files. Upon init we always create the same directory
+which would be needed by blktrace but we only do this for make_request
+drivers (multiqueue) block drivers. When you race a removal of these
+devices with a blktrace setup you end up in a situation where the
+make_request recursive debugfs removal will sweep away the blktrace
+files and then later blktrace will also try to remove individual
+dentries which are already NULL. The inverse is also possible and hence
+the two types of use after frees.
+
+We don't create the block debugfs directory on init for these types of
+block devices:
+
+ * request-based block driver block devices
+ * every possible partition
+ * scsi-generic
+
+And so, this race should in theory only be possible with make_request
+drivers.
+
+We can fix the UAF by simply re-using the debugfs directory for
+make_request drivers (multiqueue) and only creating the ephemeral
+directory for the other type of block devices. The new clarifications
+on relying on the q->blk_trace_mutex *and* also checking for q->blk_trace
+*prior* to processing a blktrace ensures the debugfs directories are
+only created if no possible directory name clashes are possible.
+
+This goes tested with:
+
+ o nvme partitions
+ o ISCSI with tgt, and blktracing against scsi-generic with:
+ o block
+ o tape
+ o cdrom
+ o media changer
+ o blktests
+
+This patch is part of the work which disputes the severity of
+CVE-2019-19770 which shows this issue is not a core debugfs issue, but
+a misuse of debugfs within blktace.
+
+Fixes: 6ac93117ab00 ("blktrace: use existing disk debugfs directory")
+Reported-by: syzbot+603294af2d01acfdd6da@syzkaller.appspotmail.com
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Omar Sandoval <osandov@fb.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Nicolai Stange <nstange@suse.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: yu kuai <yukuai3@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/blktrace.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 5ef0484513ecb..588e8e3960197 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -522,10 +522,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ if (!bt->msg_data)
+ goto err;
+
+- ret = -ENOENT;
+-
+- dir = debugfs_lookup(buts->name, blk_debugfs_root);
+- if (!dir)
++#ifdef CONFIG_BLK_DEBUG_FS
++ /*
++ * When tracing whole make_request drivers (multiqueue) block devices,
++ * reuse the existing debugfs directory created by the block layer on
++ * init. For request-based block devices, all partitions block devices,
++ * and scsi-generic block devices we create a temporary new debugfs
++ * directory that will be removed once the trace ends.
++ */
++ if (queue_is_mq(q) && bdev && bdev == bdev->bd_contains)
++ dir = q->debugfs_dir;
++ else
++#endif
+ bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root);
+
+ bt->dev = dev;
+@@ -563,8 +571,6 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+
+ ret = 0;
+ err:
+- if (dir && !bt->dir)
+- dput(dir);
+ if (ret)
+ blk_trace_free(bt);
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From 2c46af12f3c8e9eb2227127bf019c714ff97a837 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 20:25:17 +0900
+Subject: block: don't do revalidate zones on invalid devices
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+[ Upstream commit 1a1206dc4cf02cee4b5cbce583ee4c22368b4c28 ]
+
+When we loose a device for whatever reason while (re)scanning zones, we
+trip over a NULL pointer in blk_revalidate_zone_cb, like in the following
+log:
+
+sd 0:0:0:0: [sda] 3418095616 4096-byte logical blocks: (14.0 TB/12.7 TiB)
+sd 0:0:0:0: [sda] 52156 zones of 65536 logical blocks
+sd 0:0:0:0: [sda] Write Protect is off
+sd 0:0:0:0: [sda] Mode Sense: 37 00 00 08
+sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
+sd 0:0:0:0: [sda] REPORT ZONES start lba 1065287680 failed
+sd 0:0:0:0: [sda] REPORT ZONES: Result: hostbyte=0x00 driverbyte=0x08
+sd 0:0:0:0: [sda] Sense Key : 0xb [current]
+sd 0:0:0:0: [sda] ASC=0x0 ASCQ=0x6
+sda: failed to revalidate zones
+sd 0:0:0:0: [sda] 0 4096-byte logical blocks: (0 B/0 B)
+sda: detected capacity change from 14000519643136 to 0
+==================================================================
+BUG: KASAN: null-ptr-deref in blk_revalidate_zone_cb+0x1b7/0x550
+Write of size 8 at addr 0000000000000010 by task kworker/u4:1/58
+
+CPU: 1 PID: 58 Comm: kworker/u4:1 Not tainted 5.8.0-rc1 #692
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4-rebuilt.opensuse.org 04/01/2014
+Workqueue: events_unbound async_run_entry_fn
+Call Trace:
+ dump_stack+0x7d/0xb0
+ ? blk_revalidate_zone_cb+0x1b7/0x550
+ kasan_report.cold+0x5/0x37
+ ? blk_revalidate_zone_cb+0x1b7/0x550
+ check_memory_region+0x145/0x1a0
+ blk_revalidate_zone_cb+0x1b7/0x550
+ sd_zbc_parse_report+0x1f1/0x370
+ ? blk_req_zone_write_trylock+0x200/0x200
+ ? sectors_to_logical+0x60/0x60
+ ? blk_req_zone_write_trylock+0x200/0x200
+ ? blk_req_zone_write_trylock+0x200/0x200
+ sd_zbc_report_zones+0x3c4/0x5e0
+ ? sd_dif_config_host+0x500/0x500
+ blk_revalidate_disk_zones+0x231/0x44d
+ ? _raw_write_lock_irqsave+0xb0/0xb0
+ ? blk_queue_free_zone_bitmaps+0xd0/0xd0
+ sd_zbc_read_zones+0x8cf/0x11a0
+ sd_revalidate_disk+0x305c/0x64e0
+ ? __device_add_disk+0x776/0xf20
+ ? read_capacity_16.part.0+0x1080/0x1080
+ ? blk_alloc_devt+0x250/0x250
+ ? create_object.isra.0+0x595/0xa20
+ ? kasan_unpoison_shadow+0x33/0x40
+ sd_probe+0x8dc/0xcd2
+ really_probe+0x20e/0xaf0
+ __driver_attach_async_helper+0x249/0x2d0
+ async_run_entry_fn+0xbe/0x560
+ process_one_work+0x764/0x1290
+ ? _raw_read_unlock_irqrestore+0x30/0x30
+ worker_thread+0x598/0x12f0
+ ? __kthread_parkme+0xc6/0x1b0
+ ? schedule+0xed/0x2c0
+ ? process_one_work+0x1290/0x1290
+ kthread+0x36b/0x440
+ ? kthread_create_worker_on_cpu+0xa0/0xa0
+ ret_from_fork+0x22/0x30
+==================================================================
+
+When the device is already gone we end up with the following scenario:
+The device's capacity is 0 and thus the number of zones will be 0 as well. When
+allocating the bitmap for the conventional zones, we then trip over a NULL
+pointer.
+
+So if we encounter a zoned block device with a 0 capacity, don't dare to
+revalidate the zones sizes.
+
+Fixes: 6c6b35491422 ("block: set the zone size in blk_revalidate_disk_zones atomically")
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-zoned.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index 23831fa8701d8..480dfff69a00c 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -497,6 +497,9 @@ int blk_revalidate_disk_zones(struct gendisk *disk,
+ if (WARN_ON_ONCE(!queue_is_mq(q)))
+ return -EIO;
+
++ if (!get_capacity(disk))
++ return -EIO;
++
+ /*
+ * Ensure that all memory allocations in this context are done as if
+ * GFP_NOIO was specified.
+--
+2.25.1
+
--- /dev/null
+From bf7468f6aaa95eea9803693ea4f47ed5a09379f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 20:28:41 +0800
+Subject: Bluetooth: add a mutex lock to avoid UAF in do_enale_set
+
+From: Lihong Kou <koulihong@huawei.com>
+
+[ Upstream commit f9c70bdc279b191da8d60777c627702c06e4a37d ]
+
+In the case we set or free the global value listen_chan in
+different threads, we can encounter the UAF problems because
+the method is not protected by any lock, add one to avoid
+this bug.
+
+BUG: KASAN: use-after-free in l2cap_chan_close+0x48/0x990
+net/bluetooth/l2cap_core.c:730
+Read of size 8 at addr ffff888096950000 by task kworker/1:102/2868
+
+CPU: 1 PID: 2868 Comm: kworker/1:102 Not tainted 5.5.0-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine,
+BIOS Google 01/01/2011
+Workqueue: events do_enable_set
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x1fb/0x318 lib/dump_stack.c:118
+ print_address_description+0x74/0x5c0 mm/kasan/report.c:374
+ __kasan_report+0x149/0x1c0 mm/kasan/report.c:506
+ kasan_report+0x26/0x50 mm/kasan/common.c:641
+ __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
+ l2cap_chan_close+0x48/0x990 net/bluetooth/l2cap_core.c:730
+ do_enable_set+0x660/0x900 net/bluetooth/6lowpan.c:1074
+ process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264
+ worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
+ kthread+0x332/0x350 kernel/kthread.c:255
+ ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
+
+Allocated by task 2870:
+ save_stack mm/kasan/common.c:72 [inline]
+ set_track mm/kasan/common.c:80 [inline]
+ __kasan_kmalloc+0x118/0x1c0 mm/kasan/common.c:515
+ kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529
+ kmem_cache_alloc_trace+0x221/0x2f0 mm/slab.c:3551
+ kmalloc include/linux/slab.h:555 [inline]
+ kzalloc include/linux/slab.h:669 [inline]
+ l2cap_chan_create+0x50/0x320 net/bluetooth/l2cap_core.c:446
+ chan_create net/bluetooth/6lowpan.c:640 [inline]
+ bt_6lowpan_listen net/bluetooth/6lowpan.c:959 [inline]
+ do_enable_set+0x6a4/0x900 net/bluetooth/6lowpan.c:1078
+ process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264
+ worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
+ kthread+0x332/0x350 kernel/kthread.c:255
+ ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
+
+Freed by task 2870:
+ save_stack mm/kasan/common.c:72 [inline]
+ set_track mm/kasan/common.c:80 [inline]
+ kasan_set_free_info mm/kasan/common.c:337 [inline]
+ __kasan_slab_free+0x12e/0x1e0 mm/kasan/common.c:476
+ kasan_slab_free+0xe/0x10 mm/kasan/common.c:485
+ __cache_free mm/slab.c:3426 [inline]
+ kfree+0x10d/0x220 mm/slab.c:3757
+ l2cap_chan_destroy net/bluetooth/l2cap_core.c:484 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ l2cap_chan_put+0x170/0x190 net/bluetooth/l2cap_core.c:498
+ do_enable_set+0x66c/0x900 net/bluetooth/6lowpan.c:1075
+ process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264
+ worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
+ kthread+0x332/0x350 kernel/kthread.c:255
+ ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
+
+The buggy address belongs to the object at ffff888096950000
+ which belongs to the cache kmalloc-2k of size 2048
+The buggy address is located 0 bytes inside of
+ 2048-byte region [ffff888096950000, ffff888096950800)
+The buggy address belongs to the page:
+page:ffffea00025a5400 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0
+flags: 0xfffe0000000200(slab)
+raw: 00fffe0000000200 ffffea00027d1548 ffffea0002397808 ffff8880aa400e00
+raw: 0000000000000000 ffff888096950000 0000000100000001 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff88809694ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ffff88809694ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+>ffff888096950000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff888096950080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888096950100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+
+Reported-by: syzbot+96414aa0033c363d8458@syzkaller.appspotmail.com
+Signed-off-by: Lihong Kou <koulihong@huawei.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/6lowpan.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index bb55d92691b06..cff4944d5b663 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -50,6 +50,7 @@ static bool enable_6lowpan;
+ /* We are listening incoming connections via this channel
+ */
+ static struct l2cap_chan *listen_chan;
++static DEFINE_MUTEX(set_lock);
+
+ struct lowpan_peer {
+ struct list_head list;
+@@ -1078,12 +1079,14 @@ static void do_enable_set(struct work_struct *work)
+
+ enable_6lowpan = set_enable->flag;
+
++ mutex_lock(&set_lock);
+ if (listen_chan) {
+ l2cap_chan_close(listen_chan, 0);
+ l2cap_chan_put(listen_chan);
+ }
+
+ listen_chan = bt_6lowpan_listen();
++ mutex_unlock(&set_lock);
+
+ kfree(set_enable);
+ }
+@@ -1135,11 +1138,13 @@ static ssize_t lowpan_control_write(struct file *fp,
+ if (ret == -EINVAL)
+ return ret;
+
++ mutex_lock(&set_lock);
+ if (listen_chan) {
+ l2cap_chan_close(listen_chan, 0);
+ l2cap_chan_put(listen_chan);
+ listen_chan = NULL;
+ }
++ mutex_unlock(&set_lock);
+
+ if (conn) {
+ struct lowpan_peer *peer;
+--
+2.25.1
+
--- /dev/null
+From edaa2f3b0d40271d171c5c343235caacb677c66f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 13:50:15 -0700
+Subject: Bluetooth: Allow suspend even when preparation has failed
+
+From: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+
+[ Upstream commit a9ec8423134a54c9f0ae8d4ef59e1e833ca917c2 ]
+
+It is preferable to allow suspend even when Bluetooth has problems
+preparing for sleep. When Bluetooth fails to finish preparing for
+suspend, log the error and allow the suspend notifier to continue
+instead.
+
+To also make it clearer why suspend failed, change bt_dev_dbg to
+bt_dev_err when handling the suspend timeout.
+
+Fixes: dd522a7429b07e ("Bluetooth: Handle LE devices during suspend")
+Reported-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index dbe2d79f233fb..83ce665d3cbfb 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3289,10 +3289,10 @@ static int hci_suspend_wait_event(struct hci_dev *hdev)
+ WAKE_COND, SUSPEND_NOTIFIER_TIMEOUT);
+
+ if (ret == 0) {
+- bt_dev_dbg(hdev, "Timed out waiting for suspend");
++ bt_dev_err(hdev, "Timed out waiting for suspend events");
+ for (i = 0; i < __SUSPEND_NUM_TASKS; ++i) {
+ if (test_bit(i, hdev->suspend_tasks))
+- bt_dev_dbg(hdev, "Bit %d is set", i);
++ bt_dev_err(hdev, "Suspend timeout bit: %d", i);
+ clear_bit(i, hdev->suspend_tasks);
+ }
+
+@@ -3360,12 +3360,15 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
+ ret = hci_change_suspend_state(hdev, BT_RUNNING);
+ }
+
+- /* If suspend failed, restore it to running */
+- if (ret && action == PM_SUSPEND_PREPARE)
+- hci_change_suspend_state(hdev, BT_RUNNING);
+-
+ done:
+- return ret ? notifier_from_errno(-EBUSY) : NOTIFY_STOP;
++ /* We always allow suspend even if suspend preparation failed and
++ * attempt to recover in resume.
++ */
++ if (ret)
++ bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
++ action, ret);
++
++ return NOTIFY_STOP;
+ }
+
+ /* Alloc HCI device */
+--
+2.25.1
+
--- /dev/null
+From 39ea89c1bc9b53660eb678c9fea4dc36a9e6359b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 19:52:02 +0000
+Subject: Bluetooth: btmtksdio: fix up firmware download sequence
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 737cd06072a72e8984e41af8e5919338d0c5bf2b ]
+
+Data RAM on the device have to be powered on before starting to download
+the firmware.
+
+Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
+Co-developed-by: Mark Chen <Mark-YW.Chen@mediatek.com>
+Signed-off-by: Mark Chen <Mark-YW.Chen@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmtksdio.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
+index bff095be2f971..c7ab7a23bd676 100644
+--- a/drivers/bluetooth/btmtksdio.c
++++ b/drivers/bluetooth/btmtksdio.c
+@@ -685,7 +685,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
+ const u8 *fw_ptr;
+ size_t fw_size;
+ int err, dlen;
+- u8 flag;
++ u8 flag, param;
+
+ err = request_firmware(&fw, fwname, &hdev->dev);
+ if (err < 0) {
+@@ -693,6 +693,20 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
+ return err;
+ }
+
++ /* Power on data RAM the firmware relies on. */
++ param = 1;
++ wmt_params.op = MTK_WMT_FUNC_CTRL;
++ wmt_params.flag = 3;
++ wmt_params.dlen = sizeof(param);
++ wmt_params.data = ¶m;
++ wmt_params.status = NULL;
++
++ err = mtk_hci_wmt_sync(hdev, &wmt_params);
++ if (err < 0) {
++ bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
++ return err;
++ }
++
+ fw_ptr = fw->data;
+ fw_size = fw->size;
+
+--
+2.25.1
+
--- /dev/null
+From 0d7c5f8e9e930e3e369e0a0e0ed72711cace1c56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 23:12:28 +0200
+Subject: Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth
+ controllers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
+
+[ Upstream commit cde1a8a992875a7479c4321b2a4a190c2e92ec2a ]
+
+For some reason they tend to squat on the very first CSR/
+Cambridge Silicon Radio VID/PID instead of paying fees.
+
+This is an extremely common problem; the issue goes as back as 2013
+and these devices are only getting more popular, even rebranded by
+reputable vendors and sold by retailers everywhere.
+
+So, at this point in time there are hundreds of modern dongles reusing
+the ID of what originally was an early Bluetooth 1.1 controller.
+
+Linux is the only place where they don't work due to spotty checks
+in our detection code. It only covered a minimum subset.
+
+So what's the big idea? Take advantage of the fact that all CSR
+chips report the same internal version as both the LMP sub-version and
+HCI revision number. It always matches, couple that with the manufacturer
+code, that rarely lies, and we now have a good idea of who is who.
+
+Additionally, by compiling a list of user-reported HCI/lsusb dumps, and
+searching around for legit CSR dongles in similar product ranges we can
+find what CSR BlueCore firmware supported which Bluetooth versions.
+
+That way we can narrow down ranges of fakes for each of them.
+
+e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
+ support BT 1.1 only; so it's a dead giveaway when some
+ third-party BT 4.0 dongle reuses it.
+
+So, to sum things up; there are multiple classes of fake controllers
+reusing the same 0A12:0001 VID/PID. This has been broken for a while.
+
+Known 'fake' bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
+ IC markings on 0x7558: FR3191AHAL 749H15143 (???)
+
+https://bugzilla.kernel.org/show_bug.cgi?id=60824
+
+Fixes: 81cac64ba258ae (Deal with USB devices that are faking CSR vendor)
+Reported-by: Michał Wiśniewski <brylozketrzyn@gmail.com>
+Tested-by: Mike Johnson <yuyuyak@gmail.com>
+Tested-by: Ricardo Rodrigues <ekatonb@gmail.com>
+Tested-by: M.Hanny Sabbagh <mhsabbagh@outlook.com>
+Tested-by: Oussama BEN BRAHIM <b.brahim.oussama@gmail.com>
+Tested-by: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
+Signed-off-by: Ismael Ferreras Morezuelas <swyterzone@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 74 ++++++++++++++++++++++++++-----
+ include/net/bluetooth/bluetooth.h | 2 +
+ include/net/bluetooth/hci.h | 11 +++++
+ net/bluetooth/hci_core.c | 6 ++-
+ 4 files changed, 81 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 61ffe185e0e49..a5fef9aa419fd 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1720,6 +1720,7 @@ static int btusb_setup_csr(struct hci_dev *hdev)
+ {
+ struct hci_rp_read_local_version *rp;
+ struct sk_buff *skb;
++ bool is_fake = false;
+
+ BT_DBG("%s", hdev->name);
+
+@@ -1739,18 +1740,69 @@ static int btusb_setup_csr(struct hci_dev *hdev)
+
+ rp = (struct hci_rp_read_local_version *)skb->data;
+
+- /* Detect controllers which aren't real CSR ones. */
++ /* Detect a wide host of Chinese controllers that aren't CSR.
++ *
++ * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
++ *
++ * The main thing they have in common is that these are really popular low-cost
++ * options that support newer Bluetooth versions but rely on heavy VID/PID
++ * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
++ *
++ * We detect actual CSR devices by checking that the HCI manufacturer code
++ * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
++ * HCI rev values always match. As they both store the firmware number.
++ */
+ if (le16_to_cpu(rp->manufacturer) != 10 ||
+- le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
++ le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
++ is_fake = true;
++
++ /* Known legit CSR firmware build numbers and their supported BT versions:
++ * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
++ * - 1.2 (0x2) -> 0x04d9, 0x0529
++ * - 2.0 (0x3) -> 0x07a6, 0x07ad, 0x0c5c
++ * - 2.1 (0x4) -> 0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
++ * - 4.0 (0x6) -> 0x1d86, 0x2031, 0x22bb
++ *
++ * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
++ * support BT 1.1 only; so it's a dead giveaway when some
++ * third-party BT 4.0 dongle reuses it.
++ */
++ else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
++ le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_1)
++ is_fake = true;
++
++ else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
++ le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_2)
++ is_fake = true;
++
++ else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
++ le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_0)
++ is_fake = true;
++
++ else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
++ le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_1)
++ is_fake = true;
++
++ else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
++ le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0)
++ is_fake = true;
++
++ if (is_fake) {
++ bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds...");
++
++ /* Generally these clones have big discrepancies between
++ * advertised features and what's actually supported.
++ * Probably will need to be expanded in the future;
++ * without these the controller will lock up.
++ */
++ set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
++ set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
++
+ /* Clear the reset quirk since this is not an actual
+ * early Bluetooth 1.1 device from CSR.
+ */
+ clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
+-
+- /* These fake CSR controllers have all a broken
+- * stored link key handling and so just disable it.
+- */
+- set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
++ clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
+ }
+
+ kfree_skb(skb);
+@@ -4015,11 +4067,13 @@ static int btusb_probe(struct usb_interface *intf,
+ if (bcdDevice < 0x117)
+ set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
+
++ /* This must be set first in case we disable it for fakes */
++ set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
++
+ /* Fake CSR devices with broken commands */
+- if (bcdDevice <= 0x100 || bcdDevice == 0x134)
++ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0a12 &&
++ le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
+ hdev->setup = btusb_setup_csr;
+-
+- set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
+ }
+
+ if (id->driver_info & BTUSB_SNIFFER) {
+diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
+index 18190055374c9..155019220c47b 100644
+--- a/include/net/bluetooth/bluetooth.h
++++ b/include/net/bluetooth/bluetooth.h
+@@ -41,6 +41,8 @@
+ #define BLUETOOTH_VER_1_1 1
+ #define BLUETOOTH_VER_1_2 2
+ #define BLUETOOTH_VER_2_0 3
++#define BLUETOOTH_VER_2_1 4
++#define BLUETOOTH_VER_4_0 6
+
+ /* Reserv for core and drivers use */
+ #define BT_SKB_RESERVE 8
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index 16ab6ce878834..1c321b6d1ed85 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -227,6 +227,17 @@ enum {
+ * supported.
+ */
+ HCI_QUIRK_VALID_LE_STATES,
++
++ /* When this quirk is set, then erroneous data reporting
++ * is ignored. This is mainly due to the fact that the HCI
++ * Read Default Erroneous Data Reporting command is advertised,
++ * but not supported; these controllers often reply with unknown
++ * command and tend to lock up randomly. Needing a hard reset.
++ *
++ * This quirk can be set before hci_register_dev is called or
++ * during the hdev->setup vendor callback.
++ */
++ HCI_QUIRK_BROKEN_ERR_DATA_REPORTING,
+ };
+
+ /* HCI device flags */
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 83ce665d3cbfb..2a0968be22bff 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -606,7 +606,8 @@ static int hci_init3_req(struct hci_request *req, unsigned long opt)
+ if (hdev->commands[8] & 0x01)
+ hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
+
+- if (hdev->commands[18] & 0x04)
++ if (hdev->commands[18] & 0x04 &&
++ !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
+ hci_req_add(req, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 0, NULL);
+
+ /* Some older Broadcom based Bluetooth 1.2 controllers do not
+@@ -851,7 +852,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt)
+ /* Set erroneous data reporting if supported to the wideband speech
+ * setting value
+ */
+- if (hdev->commands[18] & 0x08) {
++ if (hdev->commands[18] & 0x08 &&
++ !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) {
+ bool enabled = hci_dev_test_flag(hdev,
+ HCI_WIDEBAND_SPEECH_ENABLED);
+
+--
+2.25.1
+
--- /dev/null
+From c4b2e5af579219d507dae3f2290c319ecfec69c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 19:52:01 +0000
+Subject: Bluetooth: btusb: fix up firmware download sequence
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit f645125711c80f9651e4a57403d799070c6ad13b ]
+
+Data RAM on the device have to be powered on before starting to download
+the firmware.
+
+Fixes: a1c49c434e15 ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices")
+Co-developed-by: Mark Chen <Mark-YW.Chen@mediatek.com>
+Signed-off-by: Mark Chen <Mark-YW.Chen@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 5f022e9cf667e..61ffe185e0e49 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -2925,7 +2925,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
+ const u8 *fw_ptr;
+ size_t fw_size;
+ int err, dlen;
+- u8 flag;
++ u8 flag, param;
+
+ err = request_firmware(&fw, fwname, &hdev->dev);
+ if (err < 0) {
+@@ -2933,6 +2933,20 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
+ return err;
+ }
+
++ /* Power on data RAM the firmware relies on. */
++ param = 1;
++ wmt_params.op = BTMTK_WMT_FUNC_CTRL;
++ wmt_params.flag = 3;
++ wmt_params.dlen = sizeof(param);
++ wmt_params.data = ¶m;
++ wmt_params.status = NULL;
++
++ err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
++ if (err < 0) {
++ bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
++ return err;
++ }
++
+ fw_ptr = fw->data;
+ fw_size = fw->size;
+
+--
+2.25.1
+
--- /dev/null
+From e9577eaf1aacf688006358beaa3e2b77c891c2fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 09:58:07 -0700
+Subject: Bluetooth: Fix suspend notifier race
+
+From: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+
+[ Upstream commit 4e8c36c3b0d73d46aa27cfd4308aaa445a1067df ]
+
+Unregister from suspend notifications and cancel suspend preparations
+before running hci_dev_do_close. Otherwise, the suspend notifier may
+race with unregister and cause cmd_timeout even after hdev has been
+freed.
+
+Below is the trace from when this panic was seen:
+
+[ 832.578518] Bluetooth: hci_core.c:hci_cmd_timeout() hci0: command 0x0c05 tx timeout
+[ 832.586200] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 832.586203] #PF: supervisor read access in kernel mode
+[ 832.586205] #PF: error_code(0x0000) - not-present page
+[ 832.586206] PGD 0 P4D 0
+[ 832.586210] PM: suspend exit
+[ 832.608870] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[ 832.613232] CPU: 3 PID: 10755 Comm: kworker/3:7 Not tainted 5.4.44-04894-g1e9dbb96a161 #1
+[ 832.630036] Workqueue: events hci_cmd_timeout [bluetooth]
+[ 832.630046] RIP: 0010:__queue_work+0xf0/0x374
+[ 832.630051] RSP: 0018:ffff9b5285f1fdf8 EFLAGS: 00010046
+[ 832.674033] RAX: ffff8a97681bac00 RBX: 0000000000000000 RCX: ffff8a976a000600
+[ 832.681162] RDX: 0000000000000000 RSI: 0000000000000009 RDI: ffff8a976a000748
+[ 832.688289] RBP: ffff9b5285f1fe38 R08: 0000000000000000 R09: ffff8a97681bac00
+[ 832.695418] R10: 0000000000000002 R11: ffff8a976a0006d8 R12: ffff8a9745107600
+[ 832.698045] usb 1-6: new full-speed USB device number 119 using xhci_hcd
+[ 832.702547] R13: ffff8a9673658850 R14: 0000000000000040 R15: 000000000000001e
+[ 832.702549] FS: 0000000000000000(0000) GS:ffff8a976af80000(0000) knlGS:0000000000000000
+[ 832.702550] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 832.702550] CR2: 0000000000000000 CR3: 000000010415a000 CR4: 00000000003406e0
+[ 832.702551] Call Trace:
+[ 832.702558] queue_work_on+0x3f/0x68
+[ 832.702562] process_one_work+0x1db/0x396
+[ 832.747397] worker_thread+0x216/0x375
+[ 832.751147] kthread+0x138/0x140
+[ 832.754377] ? pr_cont_work+0x58/0x58
+[ 832.758037] ? kthread_blkcg+0x2e/0x2e
+[ 832.761787] ret_from_fork+0x22/0x40
+[ 832.846191] ---[ end trace fa93f466da517212 ]---
+
+Fixes: 9952d90ea2885 ("Bluetooth: Handle PM_SUSPEND_PREPARE and PM_POST_SUSPEND")
+Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+Reviewed-by: Miao-chen Chou <mcchou@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 2a0968be22bff..41fba93d857a6 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3608,9 +3608,10 @@ void hci_unregister_dev(struct hci_dev *hdev)
+
+ cancel_work_sync(&hdev->power_on);
+
+- hci_dev_do_close(hdev);
+-
+ unregister_pm_notifier(&hdev->suspend_notifier);
++ cancel_work_sync(&hdev->suspend_prepare);
++
++ hci_dev_do_close(hdev);
+
+ if (!test_bit(HCI_INIT, &hdev->flags) &&
+ !hci_dev_test_flag(hdev, HCI_SETUP) &&
+--
+2.25.1
+
--- /dev/null
+From 04d8ea3f2e301377813096d742c5e3af684fa62e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 19:43:33 +0200
+Subject: Bluetooth: Fix update of connection state in `hci_encrypt_cfm`
+
+From: Patrick Steinhardt <ps@pks.im>
+
+[ Upstream commit 339ddaa626995bc6218972ca241471f3717cc5f4 ]
+
+Starting with the upgrade to v5.8-rc3, I've noticed I wasn't able to
+connect to my Bluetooth headset properly anymore. While connecting to
+the device would eventually succeed, bluetoothd seemed to be confused
+about the current connection state where the state was flapping hence
+and forth. Bisecting this issue led to commit 3ca44c16b0dc (Bluetooth:
+Consolidate encryption handling in hci_encrypt_cfm, 2020-05-19), which
+refactored `hci_encrypt_cfm` to also handle updating the connection
+state.
+
+The commit in question changed the code to call `hci_connect_cfm` inside
+`hci_encrypt_cfm` and to change the connection state. But with the
+conversion, we now only update the connection state if a status was set
+already. In fact, the reverse should be true: the status should be
+updated if no status is yet set. So let's fix the isuse by reversing the
+condition.
+
+Fixes: 3ca44c16b0dc ("Bluetooth: Consolidate encryption handling in hci_encrypt_cfm")
+Signed-off-by: Patrick Steinhardt <ps@pks.im>
+Acked-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index cdd4f1db8670e..da3728871e85d 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1387,7 +1387,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
+ __u8 encrypt;
+
+ if (conn->state == BT_CONFIG) {
+- if (status)
++ if (!status)
+ conn->state = BT_CONNECTED;
+
+ hci_connect_cfm(conn, status);
+--
+2.25.1
+
--- /dev/null
+From 8b6cc38ceec1438f0b44e6661ee88210d9abc575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 10:37:15 +0800
+Subject: Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit a7ad4b6119d740b1ec5788f1b98be0fd1c1b5a5a ]
+
+HCI_UART_RESET_ON_INIT belongs in hdev_flags, not flags.
+
+Fixes: ce945552fde4a09 ("Bluetooth: hci_h5: Add support for serdev enumerated devices")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_h5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index e60b2e0773db1..e41854e0d79aa 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -793,7 +793,7 @@ static int h5_serdev_probe(struct serdev_device *serdev)
+ if (!h5)
+ return -ENOMEM;
+
+- set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.flags);
++ set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.hdev_flags);
+
+ h5->hu = &h5->serdev_hu;
+ h5->serdev_hu.serdev = serdev;
+--
+2.25.1
+
--- /dev/null
+From b63eea5e92723bc02cbd90071f9807d3cfdf4e7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 21:27:08 +0530
+Subject: Bluetooth: hci_qca: Bug fix during SSR timeout
+
+From: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+
+[ Upstream commit f98aa80ff78c34fe328eb9cd3e2cc3058e42bcfd ]
+
+Due to race conditions between qca_hw_error and qca_controller_memdump
+during SSR timeout,the same pointer is freed twice. This results in a
+double free. Now a lock is acquired before checking the stauts of SSR
+state.
+
+Fixes: d841502c79e3 ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
+Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 328919b79f7b9..74245f20a309e 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -991,8 +991,11 @@ static void qca_controller_memdump(struct work_struct *work)
+ while ((skb = skb_dequeue(&qca->rx_memdump_q))) {
+
+ mutex_lock(&qca->hci_memdump_lock);
+- /* Skip processing the received packets if timeout detected. */
+- if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT) {
++ /* Skip processing the received packets if timeout detected
++ * or memdump collection completed.
++ */
++ if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
++ qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
+ mutex_unlock(&qca->hci_memdump_lock);
+ return;
+ }
+@@ -1494,8 +1497,6 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
+ {
+ struct hci_uart *hu = hci_get_drvdata(hdev);
+ struct qca_data *qca = hu->priv;
+- struct qca_memdump_data *qca_memdump = qca->qca_memdump;
+- char *memdump_buf = NULL;
+
+ set_bit(QCA_SSR_TRIGGERED, &qca->flags);
+ set_bit(QCA_HW_ERROR_EVENT, &qca->flags);
+@@ -1519,19 +1520,23 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
+ qca_wait_for_dump_collection(hdev);
+ }
+
++ mutex_lock(&qca->hci_memdump_lock);
+ if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
+ bt_dev_err(hu->hdev, "clearing allocated memory due to memdump timeout");
+- mutex_lock(&qca->hci_memdump_lock);
+- if (qca_memdump)
+- memdump_buf = qca_memdump->memdump_buf_head;
+- vfree(memdump_buf);
+- kfree(qca_memdump);
+- qca->qca_memdump = NULL;
++ if (qca->qca_memdump) {
++ vfree(qca->qca_memdump->memdump_buf_head);
++ kfree(qca->qca_memdump);
++ qca->qca_memdump = NULL;
++ }
+ qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
+ cancel_delayed_work(&qca->ctrl_memdump_timeout);
+- skb_queue_purge(&qca->rx_memdump_q);
+- mutex_unlock(&qca->hci_memdump_lock);
++ }
++ mutex_unlock(&qca->hci_memdump_lock);
++
++ if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
++ qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
+ cancel_work_sync(&qca->ctrl_memdump_evt);
++ skb_queue_purge(&qca->rx_memdump_q);
+ }
+
+ clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
+--
+2.25.1
+
--- /dev/null
+From 4f7d7dde13a5858a48b65fa30bba838f45c9ce95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 17:01:12 +0530
+Subject: Bluetooth: hci_qca: Bug fixes for SSR
+
+From: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+
+[ Upstream commit 3344537f614b966f726c1ec044d1c70a8cabe178 ]
+
+1.During SSR for command time out if BT SoC goes to inresponsive
+state, power cycling of BT SoC was not happening. Given the fix by
+sending hw error event to reset the BT SoC.
+
+2.If SSR is triggered then ignore the transmit data requests to
+BT SoC until SSR is completed.
+
+Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 40 +++++++++++++++++++++++++++++++++----
+ 1 file changed, 36 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 81c3c38baba18..3788ec7a4ad6b 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -72,7 +72,8 @@ enum qca_flags {
+ QCA_DROP_VENDOR_EVENT,
+ QCA_SUSPENDING,
+ QCA_MEMDUMP_COLLECTION,
+- QCA_HW_ERROR_EVENT
++ QCA_HW_ERROR_EVENT,
++ QCA_SSR_TRIGGERED
+ };
+
+ enum qca_capabilities {
+@@ -862,6 +863,13 @@ static int qca_enqueue(struct hci_uart *hu, struct sk_buff *skb)
+ BT_DBG("hu %p qca enq skb %p tx_ibs_state %d", hu, skb,
+ qca->tx_ibs_state);
+
++ if (test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
++ /* As SSR is in progress, ignore the packets */
++ bt_dev_dbg(hu->hdev, "SSR is in progress");
++ kfree_skb(skb);
++ return 0;
++ }
++
+ /* Prepend skb with frame type */
+ memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
+
+@@ -1128,6 +1136,7 @@ static int qca_controller_memdump_event(struct hci_dev *hdev,
+ struct hci_uart *hu = hci_get_drvdata(hdev);
+ struct qca_data *qca = hu->priv;
+
++ set_bit(QCA_SSR_TRIGGERED, &qca->flags);
+ skb_queue_tail(&qca->rx_memdump_q, skb);
+ queue_work(qca->workqueue, &qca->ctrl_memdump_evt);
+
+@@ -1488,6 +1497,7 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
+ struct qca_memdump_data *qca_memdump = qca->qca_memdump;
+ char *memdump_buf = NULL;
+
++ set_bit(QCA_SSR_TRIGGERED, &qca->flags);
+ set_bit(QCA_HW_ERROR_EVENT, &qca->flags);
+ bt_dev_info(hdev, "mem_dump_status: %d", qca->memdump_state);
+
+@@ -1532,10 +1542,30 @@ static void qca_cmd_timeout(struct hci_dev *hdev)
+ struct hci_uart *hu = hci_get_drvdata(hdev);
+ struct qca_data *qca = hu->priv;
+
+- if (qca->memdump_state == QCA_MEMDUMP_IDLE)
++ set_bit(QCA_SSR_TRIGGERED, &qca->flags);
++ if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
++ set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
+ qca_send_crashbuffer(hu);
+- else
+- bt_dev_info(hdev, "Dump collection is in process");
++ qca_wait_for_dump_collection(hdev);
++ } else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
++ /* Let us wait here until memory dump collected or
++ * memory dump timer expired.
++ */
++ bt_dev_info(hdev, "waiting for dump to complete");
++ qca_wait_for_dump_collection(hdev);
++ }
++
++ mutex_lock(&qca->hci_memdump_lock);
++ if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
++ qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
++ if (!test_bit(QCA_HW_ERROR_EVENT, &qca->flags)) {
++ /* Inject hw error event to reset the device
++ * and driver.
++ */
++ hci_reset_dev(hu->hdev);
++ }
++ }
++ mutex_unlock(&qca->hci_memdump_lock);
+ }
+
+ static int qca_wcn3990_init(struct hci_uart *hu)
+@@ -1646,6 +1676,8 @@ static int qca_setup(struct hci_uart *hu)
+ if (ret)
+ return ret;
+
++ clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
++
+ if (qca_is_wcn399x(soc_type)) {
+ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+
+--
+2.25.1
+
--- /dev/null
+From 788f7cbcce382f28ff79dd784d22d6494f091606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 May 2020 12:59:48 +0300
+Subject: Bluetooth: hci_qca: Fix an error pointer dereference
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4c07a5d7aeb39f559b29aa58ec9a8a5ab4282cb0 ]
+
+When a function like devm_clk_get_optional() function returns both error
+pointers on error and NULL then the NULL return means that the optional
+feature is deliberately disabled. It is a special sort of success and
+should not trigger an error message. The surrounding code should be
+written to check for NULL and not crash.
+
+On the other hand, if we encounter an error, then the probe from should
+clean up and return a failure.
+
+In this code, if devm_clk_get_optional() returns an error pointer then
+the kernel will crash inside the call to:
+
+ clk_set_rate(qcadev->susclk, SUSCLK_RATE_32KHZ);
+
+The error handling must be updated to prevent that.
+
+Fixes: 77131dfec6af ("Bluetooth: hci_qca: Replace devm_gpiod_get() with devm_gpiod_get_optional()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 3788ec7a4ad6b..25659b8b0c0c8 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1994,17 +1994,17 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ }
+
+ qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
+- if (!qcadev->susclk) {
++ if (IS_ERR(qcadev->susclk)) {
+ dev_warn(&serdev->dev, "failed to acquire clk\n");
+- } else {
+- err = clk_set_rate(qcadev->susclk, SUSCLK_RATE_32KHZ);
+- if (err)
+- return err;
+-
+- err = clk_prepare_enable(qcadev->susclk);
+- if (err)
+- return err;
++ return PTR_ERR(qcadev->susclk);
+ }
++ err = clk_set_rate(qcadev->susclk, SUSCLK_RATE_32KHZ);
++ if (err)
++ return err;
++
++ err = clk_prepare_enable(qcadev->susclk);
++ if (err)
++ return err;
+
+ err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
+ if (err) {
+--
+2.25.1
+
--- /dev/null
+From 1db6b81306d32a3f676252682f6645c5bbd5b9c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 17:51:31 +0530
+Subject: Bluetooth: hci_qca: Increase SoC idle timeout to 200ms
+
+From: Balakrishna Godavarthi <bgodavar@codeaurora.org>
+
+[ Upstream commit 2d68476cfc2afa1a1a2d9007a23264ffc6308e77 ]
+
+In some version of WCN399x, SoC idle timeout is configured
+as 80ms instead of 20ms or 40ms. To honor all the SoC's
+supported in the driver increasing SoC idle timeout to 200ms.
+
+Fixes: 41d5b25fed0a0 ("Bluetooth: hci_qca: add PM support")
+Signed-off-by: Balakrishna Godavarthi <bgodavar@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 74245f20a309e..483766b745178 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -46,7 +46,7 @@
+ #define HCI_MAX_IBS_SIZE 10
+
+ #define IBS_WAKE_RETRANS_TIMEOUT_MS 100
+-#define IBS_BTSOC_TX_IDLE_TIMEOUT_MS 40
++#define IBS_BTSOC_TX_IDLE_TIMEOUT_MS 200
+ #define IBS_HOST_TX_IDLE_TIMEOUT_MS 2000
+ #define CMD_TRANS_TIMEOUT_MS 100
+ #define MEMDUMP_TIMEOUT_MS 8000
+--
+2.25.1
+
--- /dev/null
+From 87397d3078521261379970513fda809df336fb25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 11:46:09 -0700
+Subject: Bluetooth: hci_qca: Only remove TX clock vote after TX is completed
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit eff981f6579d5797d68d27afc0eede529ac8778a ]
+
+qca_suspend() removes the vote for the UART TX clock after
+writing an IBS sleep request to the serial buffer. This is
+not a good idea since there is no guarantee that the request
+has been sent at this point. Instead remove the vote after
+successfully entering IBS sleep. This also fixes the issue
+of the vote being removed in case of an aborted suspend due
+to a failure of entering IBS sleep.
+
+Fixes: 41d5b25fed0a0 ("Bluetooth: hci_qca: add PM support")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 25659b8b0c0c8..328919b79f7b9 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -2115,8 +2115,6 @@ static int __maybe_unused qca_suspend(struct device *dev)
+
+ qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
+ qca->ibs_sent_slps++;
+-
+- qca_wq_serial_tx_clock_vote_off(&qca->ws_tx_vote_off);
+ break;
+
+ case HCI_IBS_TX_ASLEEP:
+@@ -2144,8 +2142,10 @@ static int __maybe_unused qca_suspend(struct device *dev)
+ qca->rx_ibs_state == HCI_IBS_RX_ASLEEP,
+ msecs_to_jiffies(IBS_BTSOC_TX_IDLE_TIMEOUT_MS));
+
+- if (ret > 0)
++ if (ret > 0) {
++ qca_wq_serial_tx_clock_vote_off(&qca->ws_tx_vote_off);
+ return 0;
++ }
+
+ if (ret == 0)
+ ret = -ETIMEDOUT;
+--
+2.25.1
+
--- /dev/null
+From f07d0014a4bd5e69570f5bab3af7ca14af97b1b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 21:23:00 +0530
+Subject: Bluetooth: hci_qca: Stop collecting memdump again for command timeout
+ during SSR
+
+From: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+
+[ Upstream commit 58789a1990c1a849a461ac912e72a698a771951a ]
+
+Setting memdump state to idle prior to setting of callback function
+pointer for command timeout to NULL,causing the issue.Now moved the
+initialisation of memdump state to qca_setup().
+
+Fixes: d841502c79e3 ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
+Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 483766b745178..9150b0c3f302a 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1676,6 +1676,8 @@ static int qca_setup(struct hci_uart *hu)
+ bt_dev_info(hdev, "setting up %s",
+ qca_is_wcn399x(soc_type) ? "wcn399x" : "ROME/QCA6390");
+
++ qca->memdump_state = QCA_MEMDUMP_IDLE;
++
+ retry:
+ ret = qca_power_on(hdev);
+ if (ret)
+@@ -1825,9 +1827,6 @@ static void qca_power_shutdown(struct hci_uart *hu)
+ qca_flush(hu);
+ spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
+
+- hu->hdev->hw_error = NULL;
+- hu->hdev->cmd_timeout = NULL;
+-
+ /* Non-serdev device usually is powered by external power
+ * and don't need additional action in driver for power down
+ */
+@@ -1849,6 +1848,9 @@ static int qca_power_off(struct hci_dev *hdev)
+ struct qca_data *qca = hu->priv;
+ enum qca_btsoc_type soc_type = qca_soc_type(hu);
+
++ hu->hdev->hw_error = NULL;
++ hu->hdev->cmd_timeout = NULL;
++
+ /* Stop sending shutdown command if soc crashes. */
+ if (soc_type != QCA_ROME
+ && qca->memdump_state == QCA_MEMDUMP_IDLE) {
+@@ -1856,7 +1858,6 @@ static int qca_power_off(struct hci_dev *hdev)
+ usleep_range(8000, 10000);
+ }
+
+- qca->memdump_state = QCA_MEMDUMP_IDLE;
+ qca_power_shutdown(hu);
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From f5b572936993ece4f5a89dbac1c78f4ebd91d821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 10:37:16 +0800
+Subject: Bluetooth: hci_serdev: Only unregister device if it was registered
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit 202798db9570104728dce8bb57dfeed47ce764bc ]
+
+We should not call hci_unregister_dev if the device was not
+successfully registered.
+
+Fixes: c34dc3bfa7642fd ("Bluetooth: hci_serdev: Introduce hci_uart_unregister_device()")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_serdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 599855e4c57c1..7b233312e723f 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -355,7 +355,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
+ struct hci_dev *hdev = hu->hdev;
+
+ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+- hci_unregister_dev(hdev);
++ if (test_bit(HCI_UART_REGISTERED, &hu->flags))
++ hci_unregister_dev(hdev);
+ hci_free_dev(hdev);
+
+ cancel_work_sync(&hu->write_work);
+--
+2.25.1
+
--- /dev/null
+From 2b5bd9c0752a6244869874b578dcc7d1cde4fe8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 15:47:15 -0700
+Subject: bpf: Fix bpf_ringbuf_output() signature to return long
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit e1613b5714ee6c186c9628e9958edf65e9d9cddd ]
+
+Due to bpf tree fix merge, bpf_ringbuf_output() signature ended up with int as
+a return type, while all other helpers got converted to returning long. So fix
+it in bpf-next now.
+
+Fixes: b0659d8a950d ("bpf: Fix definition of bpf_ringbuf_output() helper in UAPI comments")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20200727224715.652037-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/bpf.h | 2 +-
+ tools/include/uapi/linux/bpf.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 8bd33050b7bbb..a3fd55194e0b1 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -3168,7 +3168,7 @@ union bpf_attr {
+ * Return
+ * The id is returned or 0 in case the id could not be retrieved.
+ *
+- * int bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags)
++ * long bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags)
+ * Description
+ * Copy *size* bytes from *data* into a ring buffer *ringbuf*.
+ * If **BPF_RB_NO_WAKEUP** is specified in *flags*, no notification
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 8bd33050b7bbb..a3fd55194e0b1 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -3168,7 +3168,7 @@ union bpf_attr {
+ * Return
+ * The id is returned or 0 in case the id could not be retrieved.
+ *
+- * int bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags)
++ * long bpf_ringbuf_output(void *ringbuf, void *data, u64 size, u64 flags)
+ * Description
+ * Copy *size* bytes from *data* into a ring buffer *ringbuf*.
+ * If **BPF_RB_NO_WAKEUP** is specified in *flags*, no notification
+--
+2.25.1
+
--- /dev/null
+From 65a0ea65afa3a9372c03f389d40435cd2e306744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 05:20:35 -0400
+Subject: bpf: Fix fds_example SIGSEGV error
+
+From: Wenbo Zhang <ethercflow@gmail.com>
+
+[ Upstream commit eef8a42d6ce087d1c81c960ae0d14f955b742feb ]
+
+The `BPF_LOG_BUF_SIZE`'s value is `UINT32_MAX >> 8`, so define an array
+with it on stack caused an overflow.
+
+Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200710092035.28919-1-ethercflow@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/fds_example.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/samples/bpf/fds_example.c b/samples/bpf/fds_example.c
+index d5992f7872328..59f45fef51109 100644
+--- a/samples/bpf/fds_example.c
++++ b/samples/bpf/fds_example.c
+@@ -30,6 +30,8 @@
+ #define BPF_M_MAP 1
+ #define BPF_M_PROG 2
+
++char bpf_log_buf[BPF_LOG_BUF_SIZE];
++
+ static void usage(void)
+ {
+ printf("Usage: fds_example [...]\n");
+@@ -57,7 +59,6 @@ static int bpf_prog_create(const char *object)
+ BPF_EXIT_INSN(),
+ };
+ size_t insns_cnt = sizeof(insns) / sizeof(struct bpf_insn);
+- char bpf_log_buf[BPF_LOG_BUF_SIZE];
+ struct bpf_object *obj;
+ int prog_fd;
+
+--
+2.25.1
+
--- /dev/null
+From 0b6d320adba7c9a43a093ea580a1e762a11b239a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 12:51:56 -0700
+Subject: bpf: Fix pos computation for bpf_iter seq_ops->start()
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 3f9969f2c040ba2ba635b6b5a7051f404bcc634d ]
+
+Currently, the pos pointer in bpf iterator map/task/task_file
+seq_ops->start() is always incremented.
+This is incorrect. It should be increased only if
+*pos is 0 (for SEQ_START_TOKEN) since these start()
+function actually returns the first real object.
+If *pos is not 0, it merely found the object
+based on the state in seq->private, and not really
+advancing the *pos. This patch fixed this issue
+by only incrementing *pos if it is 0.
+
+Note that the old *pos calculation, although not
+correct, does not affect correctness of bpf_iter
+as bpf_iter seq_file->read() does not support llseek.
+
+This patch also renamed "mid" in bpf_map iterator
+seq_file private data to "map_id" for better clarity.
+
+Fixes: 6086d29def80 ("bpf: Add bpf_map iterator")
+Fixes: eaaacd23910f ("bpf: Add task and task/file iterator targets")
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20200722195156.4029817-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/map_iter.c | 16 ++++++----------
+ kernel/bpf/task_iter.c | 6 ++++--
+ 2 files changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/bpf/map_iter.c b/kernel/bpf/map_iter.c
+index c69071e334bf6..1a04c168563d3 100644
+--- a/kernel/bpf/map_iter.c
++++ b/kernel/bpf/map_iter.c
+@@ -6,7 +6,7 @@
+ #include <linux/kernel.h>
+
+ struct bpf_iter_seq_map_info {
+- u32 mid;
++ u32 map_id;
+ };
+
+ static void *bpf_map_seq_start(struct seq_file *seq, loff_t *pos)
+@@ -14,27 +14,23 @@ static void *bpf_map_seq_start(struct seq_file *seq, loff_t *pos)
+ struct bpf_iter_seq_map_info *info = seq->private;
+ struct bpf_map *map;
+
+- map = bpf_map_get_curr_or_next(&info->mid);
++ map = bpf_map_get_curr_or_next(&info->map_id);
+ if (!map)
+ return NULL;
+
+- ++*pos;
++ if (*pos == 0)
++ ++*pos;
+ return map;
+ }
+
+ static void *bpf_map_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ struct bpf_iter_seq_map_info *info = seq->private;
+- struct bpf_map *map;
+
+ ++*pos;
+- ++info->mid;
++ ++info->map_id;
+ bpf_map_put((struct bpf_map *)v);
+- map = bpf_map_get_curr_or_next(&info->mid);
+- if (!map)
+- return NULL;
+-
+- return map;
++ return bpf_map_get_curr_or_next(&info->map_id);
+ }
+
+ struct bpf_iter__bpf_map {
+diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
+index 4dbf2b6035f87..ac7869a389990 100644
+--- a/kernel/bpf/task_iter.c
++++ b/kernel/bpf/task_iter.c
+@@ -50,7 +50,8 @@ static void *task_seq_start(struct seq_file *seq, loff_t *pos)
+ if (!task)
+ return NULL;
+
+- ++*pos;
++ if (*pos == 0)
++ ++*pos;
+ return task;
+ }
+
+@@ -209,7 +210,8 @@ static void *task_file_seq_start(struct seq_file *seq, loff_t *pos)
+ return NULL;
+ }
+
+- ++*pos;
++ if (*pos == 0)
++ ++*pos;
+ info->task = task;
+ info->files = files;
+
+--
+2.25.1
+
--- /dev/null
+From 152fb875cd4f9151313376e91e88f7e0146856e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 12:31:45 -0700
+Subject: bpfilter: Initialize pos variable
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit a4fa458950b40d3849946daa32466392811a3716 ]
+
+Make sure 'pos' is initialized to zero before calling kernel_write().
+
+Fixes: d2ba09c17a06 ("net: add skeleton of bpfilter kernel module")
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bpfilter/bpfilter_kern.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
+index 4494ea6056cdb..42b88a92afe95 100644
+--- a/net/bpfilter/bpfilter_kern.c
++++ b/net/bpfilter/bpfilter_kern.c
+@@ -50,6 +50,7 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
+ req.len = optlen;
+ if (!bpfilter_ops.info.pid)
+ goto out;
++ pos = 0;
+ n = kernel_write(bpfilter_ops.info.pipe_to_umh, &req, sizeof(req),
+ &pos);
+ if (n != sizeof(req)) {
+--
+2.25.1
+
--- /dev/null
+From e78d6d36690a499d0e9412f80486e6ab9f5c2674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2020 02:18:33 -0500
+Subject: brcmfmac: keep SDIO watchdog running when console_interval is
+ non-zero
+
+From: Wright Feng <wright.feng@cypress.com>
+
+[ Upstream commit eccbf46b15bb3e35d004148f7c3a8fa8e9b26c1e ]
+
+brcmfmac host driver makes SDIO bus sleep and stops SDIO watchdog if no
+pending event or data. As a result, host driver does not poll firmware
+console buffer before buffer overflow, which leads to missing firmware
+logs. We should not stop SDIO watchdog if console_interval is non-zero
+in debug build.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200604071835.3842-4-wright.feng@cypress.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 310d8075f5d71..bc02168ebb536 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3699,7 +3699,11 @@ static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
+ if (bus->idlecount > bus->idletime) {
+ brcmf_dbg(SDIO, "idle\n");
+ sdio_claim_host(bus->sdiodev->func1);
+- brcmf_sdio_wd_timer(bus, false);
++#ifdef DEBUG
++ if (!BRCMF_FWCON_ON() ||
++ bus->console_interval == 0)
++#endif
++ brcmf_sdio_wd_timer(bus, false);
+ bus->idlecount = 0;
+ brcmf_sdio_bus_sleep(bus, true, false);
+ sdio_release_host(bus->sdiodev->func1);
+--
+2.25.1
+
--- /dev/null
+From 90797ec96aab050009a56d31229c2d344e741c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 04:16:07 -0500
+Subject: brcmfmac: set state of hanger slot to FREE when flushing PSQ
+
+From: Wright Feng <wright.feng@cypress.com>
+
+[ Upstream commit fcdd7a875def793c38d7369633af3eba6c7cf089 ]
+
+When USB or SDIO device got abnormal bus disconnection, host driver
+tried to clean up the skbs in PSQ and TXQ (The skb's pointer in hanger
+slot linked to PSQ and TSQ), so we should set the state of skb hanger slot
+to BRCMF_FWS_HANGER_ITEM_STATE_FREE before freeing skb.
+In brcmf_fws_bus_txq_cleanup it already sets
+BRCMF_FWS_HANGER_ITEM_STATE_FREE before freeing skb, therefore we add the
+same thing in brcmf_fws_psq_flush to avoid following warning message.
+
+ [ 1580.012880] ------------ [ cut here ]------------
+ [ 1580.017550] WARNING: CPU: 3 PID: 3065 at
+drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49
+brcmu_pkt_buf_free_skb+0x21/0x30 [brcmutil]
+ [ 1580.184017] Call Trace:
+ [ 1580.186514] brcmf_fws_cleanup+0x14e/0x190 [brcmfmac]
+ [ 1580.191594] brcmf_fws_del_interface+0x70/0x90 [brcmfmac]
+ [ 1580.197029] brcmf_proto_bcdc_del_if+0xe/0x10 [brcmfmac]
+ [ 1580.202418] brcmf_remove_interface+0x69/0x190 [brcmfmac]
+ [ 1580.207888] brcmf_detach+0x90/0xe0 [brcmfmac]
+ [ 1580.212385] brcmf_usb_disconnect+0x76/0xb0 [brcmfmac]
+ [ 1580.217557] usb_unbind_interface+0x72/0x260
+ [ 1580.221857] device_release_driver_internal+0x141/0x200
+ [ 1580.227152] device_release_driver+0x12/0x20
+ [ 1580.231460] bus_remove_device+0xfd/0x170
+ [ 1580.235504] device_del+0x1d9/0x300
+ [ 1580.239041] usb_disable_device+0x9e/0x270
+ [ 1580.243160] usb_disconnect+0x94/0x270
+ [ 1580.246980] hub_event+0x76d/0x13b0
+ [ 1580.250499] process_one_work+0x144/0x360
+ [ 1580.254564] worker_thread+0x4d/0x3c0
+ [ 1580.258247] kthread+0x109/0x140
+ [ 1580.261515] ? rescuer_thread+0x340/0x340
+ [ 1580.265543] ? kthread_park+0x60/0x60
+ [ 1580.269237] ? SyS_exit_group+0x14/0x20
+ [ 1580.273118] ret_from_fork+0x25/0x30
+ [ 1580.300446] ------------ [ cut here ]------------
+
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200624091608.25154-2-wright.feng@cypress.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+index 09701262330d6..babaac682f132 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -621,6 +621,7 @@ static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
+ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+ int ifidx)
+ {
++ struct brcmf_fws_hanger_item *hi;
+ bool (*matchfn)(struct sk_buff *, void *) = NULL;
+ struct sk_buff *skb;
+ int prec;
+@@ -632,6 +633,9 @@ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+ skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+ while (skb) {
+ hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
++ hi = &fws->hanger.items[hslot];
++ WARN_ON(skb != hi->pkt);
++ hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
+ brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+ true);
+ brcmu_pkt_buf_free_skb(skb);
+--
+2.25.1
+
--- /dev/null
+From 22bb3bbd621771bedd98a8b87193f7aee8a90243 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2020 02:18:35 -0500
+Subject: brcmfmac: To fix Bss Info flag definition Bug
+
+From: Prasanna Kerekoppa <prasanna.kerekoppa@cypress.com>
+
+[ Upstream commit fa3266541b13f390eb35bdbc38ff4a03368be004 ]
+
+Bss info flag definition need to be fixed from 0x2 to 0x4
+This flag is for rssi info received on channel.
+All Firmware branches defined as 0x4 and this is bug in brcmfmac.
+
+Signed-off-by: Prasanna Kerekoppa <prasanna.kerekoppa@cypress.com>
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200604071835.3842-6-wright.feng@cypress.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+index de0ef1b545c4f..2e31cc10c1954 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -19,7 +19,7 @@
+ #define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008
+
+ #define BRCMF_BSS_INFO_VERSION 109 /* curr ver of brcmf_bss_info_le struct */
+-#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0002
++#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0004
+
+ #define BRCMF_STA_BRCM 0x00000001 /* Running a Broadcom driver */
+ #define BRCMF_STA_WME 0x00000002 /* WMM association */
+--
+2.25.1
+
--- /dev/null
+From 2e483ae47a96af8352face9f8f4369a0ced3c905 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 10:22:28 +0200
+Subject: btmrvl: Fix firmware filename for sd8977 chipset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit dbec3af5f13b88a96e31f252957ae1a82484a923 ]
+
+Firmware for sd8977 chipset is distributed by Marvell package and also as
+part of the linux-firmware repository in filename sdsd8977_combo_v2.bin.
+
+This patch fixes mwifiex driver to load correct firmware file for sd8977.
+
+Fixes: 8c57983bf7a79 ("Bluetooth: btmrvl: add support for sd8977 chipset")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmrvl_sdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
+index a296f85264331..fa11c3443583a 100644
+--- a/drivers/bluetooth/btmrvl_sdio.c
++++ b/drivers/bluetooth/btmrvl_sdio.c
+@@ -328,7 +328,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8897 = {
+
+ static const struct btmrvl_sdio_device btmrvl_sdio_sd8977 = {
+ .helper = NULL,
+- .firmware = "mrvl/sd8977_uapsta.bin",
++ .firmware = "mrvl/sdsd8977_combo_v2.bin",
+ .reg = &btmrvl_reg_8977,
+ .support_pscan_win_report = true,
+ .sd_blksz_fw_dl = 256,
+@@ -1831,6 +1831,6 @@ MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin");
+ MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin");
+ MODULE_FIRMWARE("mrvl/sd8887_uapsta.bin");
+ MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin");
+-MODULE_FIRMWARE("mrvl/sd8977_uapsta.bin");
++MODULE_FIRMWARE("mrvl/sdsd8977_combo_v2.bin");
+ MODULE_FIRMWARE("mrvl/sd8987_uapsta.bin");
+ MODULE_FIRMWARE("mrvl/sd8997_uapsta.bin");
+--
+2.25.1
+
--- /dev/null
+From e03344ed4ae6af0c5f826fc42e155ab1a38e7525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 10:22:29 +0200
+Subject: btmrvl: Fix firmware filename for sd8997 chipset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 00eb0cb36fad53315047af12e83c643d3a2c2e49 ]
+
+Firmware for sd8997 chipset is distributed by Marvell package and also as
+part of the linux-firmware repository in filename sdsd8997_combo_v4.bin.
+
+This patch fixes mwifiex driver to load correct firmware file for sd8997.
+
+Fixes: f0ef67485f591 ("Bluetooth: btmrvl: add sd8997 chipset support")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmrvl_sdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
+index fa11c3443583a..64ee799c17612 100644
+--- a/drivers/bluetooth/btmrvl_sdio.c
++++ b/drivers/bluetooth/btmrvl_sdio.c
+@@ -346,7 +346,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8987 = {
+
+ static const struct btmrvl_sdio_device btmrvl_sdio_sd8997 = {
+ .helper = NULL,
+- .firmware = "mrvl/sd8997_uapsta.bin",
++ .firmware = "mrvl/sdsd8997_combo_v4.bin",
+ .reg = &btmrvl_reg_8997,
+ .support_pscan_win_report = true,
+ .sd_blksz_fw_dl = 256,
+@@ -1833,4 +1833,4 @@ MODULE_FIRMWARE("mrvl/sd8887_uapsta.bin");
+ MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin");
+ MODULE_FIRMWARE("mrvl/sdsd8977_combo_v2.bin");
+ MODULE_FIRMWARE("mrvl/sd8987_uapsta.bin");
+-MODULE_FIRMWARE("mrvl/sd8997_uapsta.bin");
++MODULE_FIRMWARE("mrvl/sdsd8997_combo_v4.bin");
+--
+2.25.1
+
--- /dev/null
+From 4ebb8aa29ee489fd01e45dbfda0cda1c88f9aa4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 07:23:50 +0800
+Subject: btrfs: allow btrfs_truncate_block() to fallback to nocow for data
+ space reservation
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 6d4572a9d71d5fc2affee0258d8582d39859188c ]
+
+[BUG]
+When the data space is exhausted, even if the inode has NOCOW attribute,
+we will still refuse to truncate unaligned range due to ENOSPC.
+
+The following script can reproduce it pretty easily:
+ #!/bin/bash
+
+ dev=/dev/test/test
+ mnt=/mnt/btrfs
+
+ umount $dev &> /dev/null
+ umount $mnt &> /dev/null
+
+ mkfs.btrfs -f $dev -b 1G
+ mount -o nospace_cache $dev $mnt
+ touch $mnt/foobar
+ chattr +C $mnt/foobar
+
+ xfs_io -f -c "pwrite -b 4k 0 4k" $mnt/foobar > /dev/null
+ xfs_io -f -c "pwrite -b 4k 0 1G" $mnt/padding &> /dev/null
+ sync
+
+ xfs_io -c "fpunch 0 2k" $mnt/foobar
+ umount $mnt
+
+Currently this will fail at the fpunch part.
+
+[CAUSE]
+Because btrfs_truncate_block() always reserves space without checking
+the NOCOW attribute.
+
+Since the writeback path follows NOCOW bit, we only need to bother the
+space reservation code in btrfs_truncate_block().
+
+[FIX]
+Make btrfs_truncate_block() follow btrfs_buffered_write() to try to
+reserve data space first, and fall back to NOCOW check only when we
+don't have enough space.
+
+Such always-try-reserve is an optimization introduced in
+btrfs_buffered_write(), to avoid expensive btrfs_check_can_nocow() call.
+
+This patch will export check_can_nocow() as btrfs_check_can_nocow(), and
+use it in btrfs_truncate_block() to fix the problem.
+
+Reported-by: Martin Doucha <martin.doucha@suse.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h | 2 ++
+ fs/btrfs/file.c | 12 ++++++------
+ fs/btrfs/inode.c | 44 +++++++++++++++++++++++++++++++++++++-------
+ 3 files changed, 45 insertions(+), 13 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index d404cce8ae406..7c8efa0c3ee65 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2982,6 +2982,8 @@ int btrfs_dirty_pages(struct inode *inode, struct page **pages,
+ size_t num_pages, loff_t pos, size_t write_bytes,
+ struct extent_state **cached);
+ int btrfs_fdatawrite_range(struct inode *inode, loff_t start, loff_t end);
++int btrfs_check_can_nocow(struct btrfs_inode *inode, loff_t pos,
++ size_t *write_bytes, bool nowait);
+
+ /* tree-defrag.c */
+ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index b0d2c976587e5..1523aa4eaff07 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1532,8 +1532,8 @@ lock_and_cleanup_extent_if_need(struct btrfs_inode *inode, struct page **pages,
+ return ret;
+ }
+
+-static noinline int check_can_nocow(struct btrfs_inode *inode, loff_t pos,
+- size_t *write_bytes, bool nowait)
++int btrfs_check_can_nocow(struct btrfs_inode *inode, loff_t pos,
++ size_t *write_bytes, bool nowait)
+ {
+ struct btrfs_fs_info *fs_info = inode->root->fs_info;
+ struct btrfs_root *root = inode->root;
+@@ -1648,8 +1648,8 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb,
+ if (ret < 0) {
+ if ((BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
+ BTRFS_INODE_PREALLOC)) &&
+- check_can_nocow(BTRFS_I(inode), pos,
+- &write_bytes, false) > 0) {
++ btrfs_check_can_nocow(BTRFS_I(inode), pos,
++ &write_bytes, false) > 0) {
+ /*
+ * For nodata cow case, no need to reserve
+ * data space.
+@@ -1928,8 +1928,8 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ */
+ if (!(BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
+ BTRFS_INODE_PREALLOC)) ||
+- check_can_nocow(BTRFS_I(inode), pos, &nocow_bytes,
+- true) <= 0) {
++ btrfs_check_can_nocow(BTRFS_I(inode), pos, &nocow_bytes,
++ true) <= 0) {
+ inode_unlock(inode);
+ return -EAGAIN;
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 6862cd7e21a99..3f77ec5de8ec7 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -4511,11 +4511,13 @@ int btrfs_truncate_block(struct inode *inode, loff_t from, loff_t len,
+ struct extent_state *cached_state = NULL;
+ struct extent_changeset *data_reserved = NULL;
+ char *kaddr;
++ bool only_release_metadata = false;
+ u32 blocksize = fs_info->sectorsize;
+ pgoff_t index = from >> PAGE_SHIFT;
+ unsigned offset = from & (blocksize - 1);
+ struct page *page;
+ gfp_t mask = btrfs_alloc_write_mask(mapping);
++ size_t write_bytes = blocksize;
+ int ret = 0;
+ u64 block_start;
+ u64 block_end;
+@@ -4527,11 +4529,27 @@ int btrfs_truncate_block(struct inode *inode, loff_t from, loff_t len,
+ block_start = round_down(from, blocksize);
+ block_end = block_start + blocksize - 1;
+
+- ret = btrfs_delalloc_reserve_space(inode, &data_reserved,
+- block_start, blocksize);
+- if (ret)
+- goto out;
+
++ ret = btrfs_check_data_free_space(inode, &data_reserved, block_start,
++ blocksize);
++ if (ret < 0) {
++ if ((BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
++ BTRFS_INODE_PREALLOC)) &&
++ btrfs_check_can_nocow(BTRFS_I(inode), block_start,
++ &write_bytes, false) > 0) {
++ /* For nocow case, no need to reserve data space */
++ only_release_metadata = true;
++ } else {
++ goto out;
++ }
++ }
++ ret = btrfs_delalloc_reserve_metadata(BTRFS_I(inode), blocksize);
++ if (ret < 0) {
++ if (!only_release_metadata)
++ btrfs_free_reserved_data_space(inode, data_reserved,
++ block_start, blocksize);
++ goto out;
++ }
+ again:
+ page = find_or_create_page(mapping, index, mask);
+ if (!page) {
+@@ -4600,14 +4618,26 @@ int btrfs_truncate_block(struct inode *inode, loff_t from, loff_t len,
+ set_page_dirty(page);
+ unlock_extent_cached(io_tree, block_start, block_end, &cached_state);
+
++ if (only_release_metadata)
++ set_extent_bit(&BTRFS_I(inode)->io_tree, block_start,
++ block_end, EXTENT_NORESERVE, NULL, NULL,
++ GFP_NOFS);
++
+ out_unlock:
+- if (ret)
+- btrfs_delalloc_release_space(inode, data_reserved, block_start,
+- blocksize, true);
++ if (ret) {
++ if (only_release_metadata)
++ btrfs_delalloc_release_metadata(BTRFS_I(inode),
++ blocksize, true);
++ else
++ btrfs_delalloc_release_space(inode, data_reserved,
++ block_start, blocksize, true);
++ }
+ btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize);
+ unlock_page(page);
+ put_page(page);
+ out:
++ if (only_release_metadata)
++ btrfs_drew_write_unlock(&BTRFS_I(inode)->root->snapshot_lock);
+ extent_changeset_free(data_reserved);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 3c3eb3c29f93d2493669874ca4784f0c14fd81b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 15:12:29 -0400
+Subject: btrfs: fix lockdep splat from btrfs_dump_space_info
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit ab0db043c35da3477e57d4d516492b2d51a5ca0f ]
+
+When running with -o enospc_debug you can get the following splat if one
+of the dump_space_info's trip
+
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 5.8.0-rc5+ #20 Tainted: G OE
+ ------------------------------------------------------
+ dd/563090 is trying to acquire lock:
+ ffff9e7dbf4f1e18 (&ctl->tree_lock){+.+.}-{2:2}, at: btrfs_dump_free_space+0x2b/0xa0 [btrfs]
+
+ but task is already holding lock:
+ ffff9e7e2284d428 (&cache->lock){+.+.}-{2:2}, at: btrfs_dump_space_info+0xaa/0x120 [btrfs]
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #3 (&cache->lock){+.+.}-{2:2}:
+ _raw_spin_lock+0x25/0x30
+ btrfs_add_reserved_bytes+0x3c/0x3c0 [btrfs]
+ find_free_extent+0x7ef/0x13b0 [btrfs]
+ btrfs_reserve_extent+0x9b/0x180 [btrfs]
+ btrfs_alloc_tree_block+0xc1/0x340 [btrfs]
+ alloc_tree_block_no_bg_flush+0x4a/0x60 [btrfs]
+ __btrfs_cow_block+0x122/0x530 [btrfs]
+ btrfs_cow_block+0x106/0x210 [btrfs]
+ commit_cowonly_roots+0x55/0x300 [btrfs]
+ btrfs_commit_transaction+0x4ed/0xac0 [btrfs]
+ sync_filesystem+0x74/0x90
+ generic_shutdown_super+0x22/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x36/0x70
+ cleanup_mnt+0x104/0x160
+ task_work_run+0x5f/0x90
+ __prepare_exit_to_usermode+0x1bd/0x1c0
+ do_syscall_64+0x5e/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ -> #2 (&space_info->lock){+.+.}-{2:2}:
+ _raw_spin_lock+0x25/0x30
+ btrfs_block_rsv_release+0x1a6/0x3f0 [btrfs]
+ btrfs_inode_rsv_release+0x4f/0x170 [btrfs]
+ btrfs_clear_delalloc_extent+0x155/0x480 [btrfs]
+ clear_state_bit+0x81/0x1a0 [btrfs]
+ __clear_extent_bit+0x25c/0x5d0 [btrfs]
+ clear_extent_bit+0x15/0x20 [btrfs]
+ btrfs_invalidatepage+0x2b7/0x3c0 [btrfs]
+ truncate_cleanup_page+0x47/0xe0
+ truncate_inode_pages_range+0x238/0x840
+ truncate_pagecache+0x44/0x60
+ btrfs_setattr+0x202/0x5e0 [btrfs]
+ notify_change+0x33b/0x490
+ do_truncate+0x76/0xd0
+ path_openat+0x687/0xa10
+ do_filp_open+0x91/0x100
+ do_sys_openat2+0x215/0x2d0
+ do_sys_open+0x44/0x80
+ do_syscall_64+0x52/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ -> #1 (&tree->lock#2){+.+.}-{2:2}:
+ _raw_spin_lock+0x25/0x30
+ find_first_extent_bit+0x32/0x150 [btrfs]
+ write_pinned_extent_entries.isra.0+0xc5/0x100 [btrfs]
+ __btrfs_write_out_cache+0x172/0x480 [btrfs]
+ btrfs_write_out_cache+0x7a/0xf0 [btrfs]
+ btrfs_write_dirty_block_groups+0x286/0x3b0 [btrfs]
+ commit_cowonly_roots+0x245/0x300 [btrfs]
+ btrfs_commit_transaction+0x4ed/0xac0 [btrfs]
+ close_ctree+0xf9/0x2f5 [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x36/0x70
+ cleanup_mnt+0x104/0x160
+ task_work_run+0x5f/0x90
+ __prepare_exit_to_usermode+0x1bd/0x1c0
+ do_syscall_64+0x5e/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ -> #0 (&ctl->tree_lock){+.+.}-{2:2}:
+ __lock_acquire+0x1240/0x2460
+ lock_acquire+0xab/0x360
+ _raw_spin_lock+0x25/0x30
+ btrfs_dump_free_space+0x2b/0xa0 [btrfs]
+ btrfs_dump_space_info+0xf4/0x120 [btrfs]
+ btrfs_reserve_extent+0x176/0x180 [btrfs]
+ __btrfs_prealloc_file_range+0x145/0x550 [btrfs]
+ cache_save_setup+0x28d/0x3b0 [btrfs]
+ btrfs_start_dirty_block_groups+0x1fc/0x4f0 [btrfs]
+ btrfs_commit_transaction+0xcc/0xac0 [btrfs]
+ btrfs_alloc_data_chunk_ondemand+0x162/0x4c0 [btrfs]
+ btrfs_check_data_free_space+0x4c/0xa0 [btrfs]
+ btrfs_buffered_write.isra.0+0x19b/0x740 [btrfs]
+ btrfs_file_write_iter+0x3cf/0x610 [btrfs]
+ new_sync_write+0x11e/0x1b0
+ vfs_write+0x1c9/0x200
+ ksys_write+0x68/0xe0
+ do_syscall_64+0x52/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &ctl->tree_lock --> &space_info->lock --> &cache->lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&cache->lock);
+ lock(&space_info->lock);
+ lock(&cache->lock);
+ lock(&ctl->tree_lock);
+
+ *** DEADLOCK ***
+
+ 6 locks held by dd/563090:
+ #0: ffff9e7e21d18448 (sb_writers#14){.+.+}-{0:0}, at: vfs_write+0x195/0x200
+ #1: ffff9e7dd0410ed8 (&sb->s_type->i_mutex_key#19){++++}-{3:3}, at: btrfs_file_write_iter+0x86/0x610 [btrfs]
+ #2: ffff9e7e21d18638 (sb_internal#2){.+.+}-{0:0}, at: start_transaction+0x40b/0x5b0 [btrfs]
+ #3: ffff9e7e1f05d688 (&cur_trans->cache_write_mutex){+.+.}-{3:3}, at: btrfs_start_dirty_block_groups+0x158/0x4f0 [btrfs]
+ #4: ffff9e7e2284ddb8 (&space_info->groups_sem){++++}-{3:3}, at: btrfs_dump_space_info+0x69/0x120 [btrfs]
+ #5: ffff9e7e2284d428 (&cache->lock){+.+.}-{2:2}, at: btrfs_dump_space_info+0xaa/0x120 [btrfs]
+
+ stack backtrace:
+ CPU: 3 PID: 563090 Comm: dd Tainted: G OE 5.8.0-rc5+ #20
+ Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./890FX Deluxe5, BIOS P1.40 05/03/2011
+ Call Trace:
+ dump_stack+0x96/0xd0
+ check_noncircular+0x162/0x180
+ __lock_acquire+0x1240/0x2460
+ ? wake_up_klogd.part.0+0x30/0x40
+ lock_acquire+0xab/0x360
+ ? btrfs_dump_free_space+0x2b/0xa0 [btrfs]
+ _raw_spin_lock+0x25/0x30
+ ? btrfs_dump_free_space+0x2b/0xa0 [btrfs]
+ btrfs_dump_free_space+0x2b/0xa0 [btrfs]
+ btrfs_dump_space_info+0xf4/0x120 [btrfs]
+ btrfs_reserve_extent+0x176/0x180 [btrfs]
+ __btrfs_prealloc_file_range+0x145/0x550 [btrfs]
+ ? btrfs_qgroup_reserve_data+0x1d/0x60 [btrfs]
+ cache_save_setup+0x28d/0x3b0 [btrfs]
+ btrfs_start_dirty_block_groups+0x1fc/0x4f0 [btrfs]
+ btrfs_commit_transaction+0xcc/0xac0 [btrfs]
+ ? start_transaction+0xe0/0x5b0 [btrfs]
+ btrfs_alloc_data_chunk_ondemand+0x162/0x4c0 [btrfs]
+ btrfs_check_data_free_space+0x4c/0xa0 [btrfs]
+ btrfs_buffered_write.isra.0+0x19b/0x740 [btrfs]
+ ? ktime_get_coarse_real_ts64+0xa8/0xd0
+ ? trace_hardirqs_on+0x1c/0xe0
+ btrfs_file_write_iter+0x3cf/0x610 [btrfs]
+ new_sync_write+0x11e/0x1b0
+ vfs_write+0x1c9/0x200
+ ksys_write+0x68/0xe0
+ do_syscall_64+0x52/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+This is because we're holding the block_group->lock while trying to dump
+the free space cache. However we don't need this lock, we just need it
+to read the values for the printk, so move the free space cache dumping
+outside of the block group lock.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/space-info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
+index c7bd3fdd77928..475968ccbd1d1 100644
+--- a/fs/btrfs/space-info.c
++++ b/fs/btrfs/space-info.c
+@@ -468,8 +468,8 @@ void btrfs_dump_space_info(struct btrfs_fs_info *fs_info,
+ "block group %llu has %llu bytes, %llu used %llu pinned %llu reserved %s",
+ cache->start, cache->length, cache->used, cache->pinned,
+ cache->reserved, cache->ro ? "[readonly]" : "");
+- btrfs_dump_free_space(cache, bytes);
+ spin_unlock(&cache->lock);
++ btrfs_dump_free_space(cache, bytes);
+ }
+ if (++index < BTRFS_NR_RAID_TYPES)
+ goto again;
+--
+2.25.1
+
--- /dev/null
+From 0f261360f187c1126ab0ea1fdbdd925dae4eb604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 09:12:20 +0800
+Subject: btrfs: qgroup: free per-trans reserved space when a subvolume gets
+ dropped
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit a3cf0e4342b6af9e6b34a4b913c630fbd03a82ea ]
+
+[BUG]
+Sometime fsstress could lead to qgroup warning for case like
+generic/013:
+
+ BTRFS warning (device dm-3): qgroup 0/259 has unreleased space, type 1 rsv 81920
+ ------------[ cut here ]------------
+ WARNING: CPU: 9 PID: 24535 at fs/btrfs/disk-io.c:4142 close_ctree+0x1dc/0x323 [btrfs]
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+ RIP: 0010:close_ctree+0x1dc/0x323 [btrfs]
+ Call Trace:
+ btrfs_put_super+0x15/0x17 [btrfs]
+ generic_shutdown_super+0x72/0x110
+ kill_anon_super+0x18/0x30
+ btrfs_kill_super+0x17/0x30 [btrfs]
+ deactivate_locked_super+0x3b/0xa0
+ deactivate_super+0x40/0x50
+ cleanup_mnt+0x135/0x190
+ __cleanup_mnt+0x12/0x20
+ task_work_run+0x64/0xb0
+ __prepare_exit_to_usermode+0x1bc/0x1c0
+ __syscall_return_slowpath+0x47/0x230
+ do_syscall_64+0x64/0xb0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ ---[ end trace 6c341cdf9b6cc3c1 ]---
+ BTRFS error (device dm-3): qgroup reserved space leaked
+
+While that subvolume 259 is no longer in that filesystem.
+
+[CAUSE]
+Normally per-trans qgroup reserved space is freed when a transaction is
+committed, in commit_fs_roots().
+
+However for completely dropped subvolume, that subvolume is completely
+gone, thus is no longer in the fs_roots_radix, and its per-trans
+reserved qgroup will never be freed.
+
+Since the subvolume is already gone, leaked per-trans space won't cause
+any trouble for end users.
+
+[FIX]
+Just call btrfs_qgroup_free_meta_all_pertrans() before a subvolume is
+completely dropped.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index c0bc35f932bf7..96223813b6186 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5466,6 +5466,14 @@ int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc)
+ }
+ }
+
++ /*
++ * This subvolume is going to be completely dropped, and won't be
++ * recorded as dirty roots, thus pertrans meta rsv will not be freed at
++ * commit transaction time. So free it here manually.
++ */
++ btrfs_qgroup_convert_reserved_meta(root, INT_MAX);
++ btrfs_qgroup_free_meta_all_pertrans(root);
++
+ if (test_bit(BTRFS_ROOT_IN_RADIX, &root->state))
+ btrfs_add_dropped_root(trans, root);
+ else
+--
+2.25.1
+
--- /dev/null
+From 86c633f0bef0dee2017f7be0b3efd62349ab13be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 09:59:47 -0700
+Subject: bus: ti-sysc: Add missing quirk flags for usb_host_hs
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4254632dba27271f6de66efd87e444ee405dee29 ]
+
+Similar to what we have for the legacy platform data, we need to
+configure SWSUP_SIDLE and SWSUP_MSTANDBY quirks for usb_host_hs.
+
+These are needed to drop the legacy platform data for usb_host_hs.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 191c97b84715f..fb5a901fd89e5 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1395,6 +1395,10 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY),
+ SYSC_QUIRK("tptc", 0, 0, -ENODEV, -ENODEV, 0x40007c00, 0xffffffff,
+ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY),
++ SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, 0x14, 0x50700100, 0xffffffff,
++ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY),
++ SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, -ENODEV, 0x50700101, 0xffffffff,
++ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY),
+ SYSC_QUIRK("usb_otg_hs", 0, 0x400, 0x404, 0x408, 0x00000050,
+ 0xffffffff, SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY),
+ SYSC_QUIRK("usb_otg_hs", 0, 0, 0x10, -ENODEV, 0x4ea2080d, 0xffffffff,
+@@ -1473,8 +1477,6 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ SYSC_QUIRK("tpcc", 0, 0, -ENODEV, -ENODEV, 0x40014c00, 0xffffffff, 0),
+ SYSC_QUIRK("usbhstll", 0, 0, 0x10, 0x14, 0x00000004, 0xffffffff, 0),
+ SYSC_QUIRK("usbhstll", 0, 0, 0x10, 0x14, 0x00000008, 0xffffffff, 0),
+- SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, 0x14, 0x50700100, 0xffffffff, 0),
+- SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, -ENODEV, 0x50700101, 0xffffffff, 0),
+ SYSC_QUIRK("venc", 0x58003000, 0, -ENODEV, -ENODEV, 0x00000002, 0xffffffff, 0),
+ SYSC_QUIRK("vfpe", 0, 0, 0x104, -ENODEV, 0x4d001200, 0xffffffff, 0),
+ #endif
+--
+2.25.1
+
--- /dev/null
+From 58122910d402b12bbda6eaacc0633f2dcbd9fcfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 13:08:46 +0200
+Subject: clk: bcm63xx-gate: fix last clock availability
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit cf8030d7035bd3e89c9e66f7193a7fc8057a9b9a ]
+
+In order to make the last clock available, maxbit has to be set to the
+highest bit value plus 1.
+
+Fixes: 1c099779c1e2 ("clk: add BCM63XX gated clock controller driver")
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Link: https://lore.kernel.org/r/20200609110846.4029620-1-noltari@gmail.com
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/bcm/clk-bcm63xx-gate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/bcm/clk-bcm63xx-gate.c b/drivers/clk/bcm/clk-bcm63xx-gate.c
+index 98e884957db87..911a29bd744ef 100644
+--- a/drivers/clk/bcm/clk-bcm63xx-gate.c
++++ b/drivers/clk/bcm/clk-bcm63xx-gate.c
+@@ -155,6 +155,7 @@ static int clk_bcm63xx_probe(struct platform_device *pdev)
+
+ for (entry = table; entry->name; entry++)
+ maxbit = max_t(u8, maxbit, entry->bit);
++ maxbit++;
+
+ hw = devm_kzalloc(&pdev->dev, struct_size(hw, data.hws, maxbit),
+ GFP_KERNEL);
+--
+2.25.1
+
--- /dev/null
+From eacca507778fba269de4f321c8f2dab133521f02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 12:24:10 +0530
+Subject: clk: qcom: gcc: Make disp gpll0 branch aon for sc7180/sdm845
+
+From: Taniya Das <tdas@codeaurora.org>
+
+[ Upstream commit 9c3df2b1993da9ab1110702d7b2815d5cd8c02f3 ]
+
+The display gpll0 branch clock inside GCC needs to always be enabled.
+Otherwise the AHB clk (disp_cc_mdss_ahb_clk_src) for the display clk
+controller (dispcc) will stop clocking while sourcing from gpll0 when
+this branch inside GCC is turned off during unused clk disabling. We can
+never turn this branch off because the AHB clk for the display subsystem
+is needed to read/write any registers inside the display subsystem
+including clk related ones. This makes this branch a really easy way to
+turn off AHB access to the display subsystem and cause all sorts of
+mayhem. Let's just make the clk ops keep the clk enabled forever and
+ignore any attempts to disable this clk so that dispcc accesses keep
+working.
+
+Signed-off-by: Taniya Das <tdas@codeaurora.org>
+Reported-by: Evan Green <evgreen@chromium.org>
+Link: https://lore.kernel.org/r/1594796050-14511-1-git-send-email-tdas@codeaurora.org
+Fixes: 17269568f726 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180")
+Fixes: 06391eddb60a ("clk: qcom: Add Global Clock controller (GCC) driver for SDM845")
+[sboyd@kernel.org: Fill out commit text more]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sc7180.c | 2 +-
+ drivers/clk/qcom/gcc-sdm845.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c
+index ca4383e3a02a7..538677befb86f 100644
+--- a/drivers/clk/qcom/gcc-sc7180.c
++++ b/drivers/clk/qcom/gcc-sc7180.c
+@@ -1061,7 +1061,7 @@ static struct clk_branch gcc_disp_gpll0_clk_src = {
+ .hw = &gpll0.clkr.hw,
+ },
+ .num_parents = 1,
+- .ops = &clk_branch2_ops,
++ .ops = &clk_branch2_aon_ops,
+ },
+ },
+ };
+diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
+index f6ce888098be9..90f7febaf5288 100644
+--- a/drivers/clk/qcom/gcc-sdm845.c
++++ b/drivers/clk/qcom/gcc-sdm845.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2018, 2020, The Linux Foundation. All rights reserved.
+ */
+
+ #include <linux/kernel.h>
+@@ -1344,7 +1344,7 @@ static struct clk_branch gcc_disp_gpll0_clk_src = {
+ "gpll0",
+ },
+ .num_parents = 1,
+- .ops = &clk_branch2_ops,
++ .ops = &clk_branch2_aon_ops,
+ },
+ },
+ };
+--
+2.25.1
+
--- /dev/null
+From 243aa5c72fa63698e37bfdb7dd7569da5ddbefba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 09:17:05 +0100
+Subject: clk: scmi: Fix min and max rate when registering clocks with discrete
+ rates
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit fcd2e0deae50bce48450f14c8fc5611b08d7438c ]
+
+Currently we are not initializing the scmi clock with discrete rates
+correctly. We fetch the min_rate and max_rate value only for clocks with
+ranges and ignore the ones with discrete rates. This will lead to wrong
+initialization of rate range when clock supports discrete rate.
+
+Fix this by using the first and the last rate in the sorted list of the
+discrete clock rates while registering the clock.
+
+Link: https://lore.kernel.org/r/20200709081705.46084-2-sudeep.holla@arm.com
+Fixes: 6d6a1d82eaef7 ("clk: add support for clocks provided by SCMI")
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Reported-and-tested-by: Dien Pham <dien.pham.ry@renesas.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-scmi.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
+index c491f5de0f3f4..c754dfbb73fd4 100644
+--- a/drivers/clk/clk-scmi.c
++++ b/drivers/clk/clk-scmi.c
+@@ -103,6 +103,8 @@ static const struct clk_ops scmi_clk_ops = {
+ static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk)
+ {
+ int ret;
++ unsigned long min_rate, max_rate;
++
+ struct clk_init_data init = {
+ .flags = CLK_GET_RATE_NOCACHE,
+ .num_parents = 0,
+@@ -112,9 +114,23 @@ static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk)
+
+ sclk->hw.init = &init;
+ ret = devm_clk_hw_register(dev, &sclk->hw);
+- if (!ret)
+- clk_hw_set_rate_range(&sclk->hw, sclk->info->range.min_rate,
+- sclk->info->range.max_rate);
++ if (ret)
++ return ret;
++
++ if (sclk->info->rate_discrete) {
++ int num_rates = sclk->info->list.num_rates;
++
++ if (num_rates <= 0)
++ return -EINVAL;
++
++ min_rate = sclk->info->list.rates[0];
++ max_rate = sclk->info->list.rates[num_rates - 1];
++ } else {
++ min_rate = sclk->info->range.min_rate;
++ max_rate = sclk->info->range.max_rate;
++ }
++
++ clk_hw_set_rate_range(&sclk->hw, min_rate, max_rate);
+ return ret;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From dbc64b3daabc784cf921737df5a654c3cb3e67a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Apr 2020 00:42:51 +0800
+Subject: console: newport_con: fix an issue about leak related system
+ resources
+
+From: Dejin Zheng <zhengdejin5@gmail.com>
+
+[ Upstream commit fd4b8243877250c05bb24af7fea5567110c9720b ]
+
+A call of the function do_take_over_console() can fail here.
+The corresponding system resources were not released then.
+Thus add a call of iounmap() and release_mem_region()
+together with the check of a failure predicate. and also
+add release_mem_region() on device removal.
+
+Fixes: e86bb8acc0fdc ("[PATCH] VT binding: Make newport_con support binding")
+Suggested-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200423164251.3349-1-zhengdejin5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/console/newport_con.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
+index 504cda38763e0..df3c52d721597 100644
+--- a/drivers/video/console/newport_con.c
++++ b/drivers/video/console/newport_con.c
+@@ -31,6 +31,8 @@
+ #include <linux/linux_logo.h>
+ #include <linux/font.h>
+
++#define NEWPORT_LEN 0x10000
++
+ #define FONT_DATA ((unsigned char *)font_vga_8x16.data)
+
+ /* borrowed from fbcon.c */
+@@ -42,6 +44,7 @@
+ static unsigned char *font_data[MAX_NR_CONSOLES];
+
+ static struct newport_regs *npregs;
++static unsigned long newport_addr;
+
+ static int logo_active;
+ static int topscan;
+@@ -701,7 +704,6 @@ const struct consw newport_con = {
+ static int newport_probe(struct gio_device *dev,
+ const struct gio_device_id *id)
+ {
+- unsigned long newport_addr;
+ int err;
+
+ if (!dev->resource.start)
+@@ -711,7 +713,7 @@ static int newport_probe(struct gio_device *dev,
+ return -EBUSY; /* we only support one Newport as console */
+
+ newport_addr = dev->resource.start + 0xF0000;
+- if (!request_mem_region(newport_addr, 0x10000, "Newport"))
++ if (!request_mem_region(newport_addr, NEWPORT_LEN, "Newport"))
+ return -ENODEV;
+
+ npregs = (struct newport_regs *)/* ioremap cannot fail */
+@@ -719,6 +721,11 @@ static int newport_probe(struct gio_device *dev,
+ console_lock();
+ err = do_take_over_console(&newport_con, 0, MAX_NR_CONSOLES - 1, 1);
+ console_unlock();
++
++ if (err) {
++ iounmap((void *)npregs);
++ release_mem_region(newport_addr, NEWPORT_LEN);
++ }
+ return err;
+ }
+
+@@ -726,6 +733,7 @@ static void newport_remove(struct gio_device *dev)
+ {
+ give_up_console(&newport_con);
+ iounmap((void *)npregs);
++ release_mem_region(newport_addr, NEWPORT_LEN);
+ }
+
+ static struct gio_device_id newport_ids[] = {
+--
+2.25.1
+
--- /dev/null
+From 4e386b75627e954a9984f5cbe278e089aa7809ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:57:46 -0600
+Subject: coresight: etm4x: Fix save/restore during cpu idle
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 342c8a1d1d9e418d32fa02d635cf96989f9a986e ]
+
+The ETM state save/restore incorrectly reads/writes some of the 64bit
+registers (e.g, address comparators, vmid/cid comparators etc.) using
+32bit accesses. Ensure we use the appropriate width accessors for
+the registers.
+
+Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states")
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20200716175746.3338735-18-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x.c | 16 ++++++++--------
+ drivers/hwtracing/coresight/coresight-etm4x.h | 2 +-
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index 007d7c6e91f48..6089c481f8f19 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -1202,8 +1202,8 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ }
+
+ for (i = 0; i < drvdata->nr_addr_cmp * 2; i++) {
+- state->trcacvr[i] = readl(drvdata->base + TRCACVRn(i));
+- state->trcacatr[i] = readl(drvdata->base + TRCACATRn(i));
++ state->trcacvr[i] = readq(drvdata->base + TRCACVRn(i));
++ state->trcacatr[i] = readq(drvdata->base + TRCACATRn(i));
+ }
+
+ /*
+@@ -1214,10 +1214,10 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ */
+
+ for (i = 0; i < drvdata->numcidc; i++)
+- state->trccidcvr[i] = readl(drvdata->base + TRCCIDCVRn(i));
++ state->trccidcvr[i] = readq(drvdata->base + TRCCIDCVRn(i));
+
+ for (i = 0; i < drvdata->numvmidc; i++)
+- state->trcvmidcvr[i] = readl(drvdata->base + TRCVMIDCVRn(i));
++ state->trcvmidcvr[i] = readq(drvdata->base + TRCVMIDCVRn(i));
+
+ state->trccidcctlr0 = readl(drvdata->base + TRCCIDCCTLR0);
+ state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1);
+@@ -1315,18 +1315,18 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+ }
+
+ for (i = 0; i < drvdata->nr_addr_cmp * 2; i++) {
+- writel_relaxed(state->trcacvr[i],
++ writeq_relaxed(state->trcacvr[i],
+ drvdata->base + TRCACVRn(i));
+- writel_relaxed(state->trcacatr[i],
++ writeq_relaxed(state->trcacatr[i],
+ drvdata->base + TRCACATRn(i));
+ }
+
+ for (i = 0; i < drvdata->numcidc; i++)
+- writel_relaxed(state->trccidcvr[i],
++ writeq_relaxed(state->trccidcvr[i],
+ drvdata->base + TRCCIDCVRn(i));
+
+ for (i = 0; i < drvdata->numvmidc; i++)
+- writel_relaxed(state->trcvmidcvr[i],
++ writeq_relaxed(state->trcvmidcvr[i],
+ drvdata->base + TRCVMIDCVRn(i));
+
+ writel_relaxed(state->trccidcctlr0, drvdata->base + TRCCIDCCTLR0);
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index b0d633daf7162..47729e04aac72 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -334,7 +334,7 @@ struct etmv4_save_state {
+ u64 trcacvr[ETM_MAX_SINGLE_ADDR_CMP];
+ u64 trcacatr[ETM_MAX_SINGLE_ADDR_CMP];
+ u64 trccidcvr[ETMv4_MAX_CTXID_CMP];
+- u32 trcvmidcvr[ETM_MAX_VMID_CMP];
++ u64 trcvmidcvr[ETM_MAX_VMID_CMP];
+ u32 trccidcctlr0;
+ u32 trccidcctlr1;
+ u32 trcvmidcctlr0;
+--
+2.25.1
+
--- /dev/null
+From f720530663aee649142ca3055bc686fcdad58ff8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:57:39 -0600
+Subject: coresight: etmv4: Counter values not saved on disable
+
+From: Mike Leach <mike.leach@linaro.org>
+
+[ Upstream commit 8fa43700f69703f995ea715b76be6fabdd2f05de ]
+
+The counter value registers change during operation, however this change
+is not reflected in the values seen by the user in sysfs.
+
+This fixes the issue by reading back the values on disable.
+
+Signed-off-by: Mike Leach <mike.leach@linaro.org>
+Fixes: 2e1cdfe184b52 ("coresight-etm4x: Adding CoreSight ETM4x driver")
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20200716175746.3338735-11-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index 0c35cd5e0d1d9..007d7c6e91f48 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -507,6 +507,12 @@ static void etm4_disable_hw(void *info)
+ readl_relaxed(drvdata->base + TRCSSCSRn(i));
+ }
+
++ /* read back the current counter values */
++ for (i = 0; i < drvdata->nr_cntr; i++) {
++ config->cntr_val[i] =
++ readl_relaxed(drvdata->base + TRCCNTVRn(i));
++ }
++
+ coresight_disclaim_device_unlocked(drvdata->base);
+
+ CS_LOCK(drvdata->base);
+--
+2.25.1
+
--- /dev/null
+From aae2281a9166345a9cec08bd28d26470cd3517f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:57:38 -0600
+Subject: coresight: etmv4: Fix resource selector constant
+
+From: Mike Leach <mike.leach@linaro.org>
+
+[ Upstream commit cb8bba907a4ff4ba42f1d245cb506d55829674b8 ]
+
+ETMv4 max resource selector constant incorrectly set to 16. Updated to the
+correct 32 value, and adjustments made to limited code using it.
+
+Signed-off-by: Mike Leach <mike.leach@linaro.org>
+Fixes: 2e1cdfe184b52 ("coresight-etm4x: Adding CoreSight ETM4x driver")
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20200716175746.3338735-10-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 4a695bf90582e..b0d633daf7162 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -133,7 +133,7 @@
+ #define ETMv4_MAX_CTXID_CMP 8
+ #define ETM_MAX_VMID_CMP 8
+ #define ETM_MAX_PE_CMP 8
+-#define ETM_MAX_RES_SEL 16
++#define ETM_MAX_RES_SEL 32
+ #define ETM_MAX_SS_CMP 8
+
+ #define ETM_ARCH_V4 0x40
+@@ -325,7 +325,7 @@ struct etmv4_save_state {
+ u32 trccntctlr[ETMv4_MAX_CNTR];
+ u32 trccntvr[ETMv4_MAX_CNTR];
+
+- u32 trcrsctlr[ETM_MAX_RES_SEL * 2];
++ u32 trcrsctlr[ETM_MAX_RES_SEL];
+
+ u32 trcssccr[ETM_MAX_SS_CMP];
+ u32 trcsscsr[ETM_MAX_SS_CMP];
+--
+2.25.1
+
--- /dev/null
+From cf736f8c7d35838d0bb7c64c33a6df8696ef5267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:57:42 -0600
+Subject: coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+[ Upstream commit d021f5c5ff679432c5e9faee0fd7350db2efb97c ]
+
+Reading TMC mode register without proper coresight power
+management can lead to exceptions like the one in the call
+trace below in tmc_read_unprepare_etb() when the trace data
+is read after the sink is disabled. So fix this by having
+a check for coresight sysfs mode before reading TMC mode
+management register in tmc_read_unprepare_etb() similar to
+tmc_read_prepare_etb().
+
+ SError Interrupt on CPU6, code 0xbe000411 -- SError
+ pstate: 80400089 (Nzcv daIf +PAN -UAO)
+ pc : tmc_read_unprepare_etb+0x74/0x108
+ lr : tmc_read_unprepare_etb+0x54/0x108
+ sp : ffffff80d9507c30
+ x29: ffffff80d9507c30 x28: ffffff80b3569a0c
+ x27: 0000000000000000 x26: 00000000000a0001
+ x25: ffffff80cbae9550 x24: 0000000000000010
+ x23: ffffffd07296b0f0 x22: ffffffd0109ee028
+ x21: 0000000000000000 x20: ffffff80d19e70e0
+ x19: ffffff80d19e7080 x18: 0000000000000000
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: 0000000000000000 x14: 0000000000000000
+ x13: 0000000000000000 x12: 0000000000000000
+ x11: 0000000000000000 x10: dfffffd000000001
+ x9 : 0000000000000000 x8 : 0000000000000002
+ x7 : ffffffd071d0fe78 x6 : 0000000000000000
+ x5 : 0000000000000080 x4 : 0000000000000001
+ x3 : ffffffd071d0fe98 x2 : 0000000000000000
+ x1 : 0000000000000004 x0 : 0000000000000001
+ Kernel panic - not syncing: Asynchronous SError Interrupt
+
+Fixes: 4525412a5046 ("coresight: tmc: making prepare/unprepare functions generic")
+Reported-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Tested-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20200716175746.3338735-14-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etf.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index 36cce2bfb7449..6375504ba8b00 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -639,15 +639,14 @@ int tmc_read_unprepare_etb(struct tmc_drvdata *drvdata)
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+
+- /* There is no point in reading a TMC in HW FIFO mode */
+- mode = readl_relaxed(drvdata->base + TMC_MODE);
+- if (mode != TMC_MODE_CIRCULAR_BUFFER) {
+- spin_unlock_irqrestore(&drvdata->spinlock, flags);
+- return -EINVAL;
+- }
+-
+ /* Re-enable the TMC if need be */
+ if (drvdata->mode == CS_MODE_SYSFS) {
++ /* There is no point in reading a TMC in HW FIFO mode */
++ mode = readl_relaxed(drvdata->base + TMC_MODE);
++ if (mode != TMC_MODE_CIRCULAR_BUFFER) {
++ spin_unlock_irqrestore(&drvdata->spinlock, flags);
++ return -EINVAL;
++ }
+ /*
+ * The trace run will continue with the same allocated trace
+ * buffer. As such zero-out the buffer so that we don't end
+--
+2.25.1
+
--- /dev/null
+From 3162d779ed1a9ff3dc155990400e5199fccdc811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 14:01:23 +0200
+Subject: cpufreq: ap806: fix cpufreq driver needs ap cpu clk
+
+From: Sven Auhagen <sven.auhagen@voleatech.de>
+
+[ Upstream commit 8c37ad2f523396e15cf002b29f8f796447c71932 ]
+
+The Armada 8K cpufreq driver needs the Armada AP CPU CLK
+to work. This dependency is currently not satisfied and
+the ARMADA_AP_CPU_CLK can not be selected independently.
+
+Add it to the cpufreq Armada8k driver.
+
+Fixes: f525a670533d ("cpufreq: ap806: add cpufreq driver for Armada 8K")
+Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/Kconfig.arm | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
+index c6cbfc8baf724..a967894c4613e 100644
+--- a/drivers/cpufreq/Kconfig.arm
++++ b/drivers/cpufreq/Kconfig.arm
+@@ -41,6 +41,7 @@ config ARM_ARMADA_37XX_CPUFREQ
+ config ARM_ARMADA_8K_CPUFREQ
+ tristate "Armada 8K CPUFreq driver"
+ depends on ARCH_MVEBU && CPUFREQ_DT
++ select ARMADA_AP_CPU_CLK
+ help
+ This enables the CPUFreq driver support for Marvell
+ Armada8k SOCs.
+--
+2.25.1
+
--- /dev/null
+From 78d0650cdadd1cc2aadd462146b45fb7eb5cf623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 16:59:18 +1000
+Subject: crc-t10dif: Fix potential crypto notify dead-lock
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 3906f640224dbe7714b52b66d7d68c0812808e19 ]
+
+The crypto notify call occurs with a read mutex held so you must
+not do any substantial work directly. In particular, you cannot
+call crypto_alloc_* as they may trigger further notifications
+which may dead-lock in the presence of another writer.
+
+This patch fixes this by postponing the work into a work queue and
+taking the same lock in the module init function.
+
+While we're at it this patch also ensures that all RCU accesses are
+marked appropriately (tested with sparse).
+
+Finally this also reveals a race condition in module param show
+function as it may be called prior to the module init function.
+It's fixed by testing whether crct10dif_tfm is NULL (this is true
+iff the init function has not completed assuming fallback is false).
+
+Fixes: 11dcb1037f40 ("crc-t10dif: Allow current transform to be...")
+Fixes: b76377543b73 ("crc-t10dif: Pick better transform if one...")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/crc-t10dif.c | 54 +++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 42 insertions(+), 12 deletions(-)
+
+diff --git a/lib/crc-t10dif.c b/lib/crc-t10dif.c
+index 8cc01a6034165..c9acf1c12cfcb 100644
+--- a/lib/crc-t10dif.c
++++ b/lib/crc-t10dif.c
+@@ -19,39 +19,46 @@
+ static struct crypto_shash __rcu *crct10dif_tfm;
+ static struct static_key crct10dif_fallback __read_mostly;
+ static DEFINE_MUTEX(crc_t10dif_mutex);
++static struct work_struct crct10dif_rehash_work;
+
+-static int crc_t10dif_rehash(struct notifier_block *self, unsigned long val, void *data)
++static int crc_t10dif_notify(struct notifier_block *self, unsigned long val, void *data)
+ {
+ struct crypto_alg *alg = data;
+- struct crypto_shash *new, *old;
+
+ if (val != CRYPTO_MSG_ALG_LOADED ||
+ static_key_false(&crct10dif_fallback) ||
+ strncmp(alg->cra_name, CRC_T10DIF_STRING, strlen(CRC_T10DIF_STRING)))
+ return 0;
+
++ schedule_work(&crct10dif_rehash_work);
++ return 0;
++}
++
++static void crc_t10dif_rehash(struct work_struct *work)
++{
++ struct crypto_shash *new, *old;
++
+ mutex_lock(&crc_t10dif_mutex);
+ old = rcu_dereference_protected(crct10dif_tfm,
+ lockdep_is_held(&crc_t10dif_mutex));
+ if (!old) {
+ mutex_unlock(&crc_t10dif_mutex);
+- return 0;
++ return;
+ }
+ new = crypto_alloc_shash("crct10dif", 0, 0);
+ if (IS_ERR(new)) {
+ mutex_unlock(&crc_t10dif_mutex);
+- return 0;
++ return;
+ }
+ rcu_assign_pointer(crct10dif_tfm, new);
+ mutex_unlock(&crc_t10dif_mutex);
+
+ synchronize_rcu();
+ crypto_free_shash(old);
+- return 0;
+ }
+
+ static struct notifier_block crc_t10dif_nb = {
+- .notifier_call = crc_t10dif_rehash,
++ .notifier_call = crc_t10dif_notify,
+ };
+
+ __u16 crc_t10dif_update(__u16 crc, const unsigned char *buffer, size_t len)
+@@ -86,19 +93,26 @@ EXPORT_SYMBOL(crc_t10dif);
+
+ static int __init crc_t10dif_mod_init(void)
+ {
++ struct crypto_shash *tfm;
++
++ INIT_WORK(&crct10dif_rehash_work, crc_t10dif_rehash);
+ crypto_register_notifier(&crc_t10dif_nb);
+- crct10dif_tfm = crypto_alloc_shash("crct10dif", 0, 0);
+- if (IS_ERR(crct10dif_tfm)) {
++ mutex_lock(&crc_t10dif_mutex);
++ tfm = crypto_alloc_shash("crct10dif", 0, 0);
++ if (IS_ERR(tfm)) {
+ static_key_slow_inc(&crct10dif_fallback);
+- crct10dif_tfm = NULL;
++ tfm = NULL;
+ }
++ RCU_INIT_POINTER(crct10dif_tfm, tfm);
++ mutex_unlock(&crc_t10dif_mutex);
+ return 0;
+ }
+
+ static void __exit crc_t10dif_mod_fini(void)
+ {
+ crypto_unregister_notifier(&crc_t10dif_nb);
+- crypto_free_shash(crct10dif_tfm);
++ cancel_work_sync(&crct10dif_rehash_work);
++ crypto_free_shash(rcu_dereference_protected(crct10dif_tfm, 1));
+ }
+
+ module_init(crc_t10dif_mod_init);
+@@ -106,11 +120,27 @@ module_exit(crc_t10dif_mod_fini);
+
+ static int crc_t10dif_transform_show(char *buffer, const struct kernel_param *kp)
+ {
++ struct crypto_shash *tfm;
++ const char *name;
++ int len;
++
+ if (static_key_false(&crct10dif_fallback))
+ return sprintf(buffer, "fallback\n");
+
+- return sprintf(buffer, "%s\n",
+- crypto_tfm_alg_driver_name(crypto_shash_tfm(crct10dif_tfm)));
++ rcu_read_lock();
++ tfm = rcu_dereference(crct10dif_tfm);
++ if (!tfm) {
++ len = sprintf(buffer, "init\n");
++ goto unlock;
++ }
++
++ name = crypto_tfm_alg_driver_name(crypto_shash_tfm(tfm));
++ len = sprintf(buffer, "%s\n", name);
++
++unlock:
++ rcu_read_unlock();
++
++ return len;
+ }
+
+ module_param_call(transform, NULL, crc_t10dif_transform_show, NULL, 0644);
+--
+2.25.1
+
--- /dev/null
+From 1eb94896a09a9306e7fcbb4ed169bd74ecc4bdb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 16:32:06 +0200
+Subject: crypto: aesni - Fix build with LLVM_IAS=1
+
+From: Sedat Dilek <sedat.dilek@gmail.com>
+
+[ Upstream commit 3347c8a079d67af21760a78cc5f2abbcf06d9571 ]
+
+When building with LLVM_IAS=1 means using Clang's Integrated Assembly (IAS)
+from LLVM/Clang >= v10.0.1-rc1+ instead of GNU/as from GNU/binutils
+I see the following breakage in Debian/testing AMD64:
+
+<instantiation>:15:74: error: too many positional arguments
+ PRECOMPUTE 8*3+8(%rsp), %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
+ ^
+ arch/x86/crypto/aesni-intel_asm.S:1598:2: note: while in macro instantiation
+ GCM_INIT %r9, 8*3 +8(%rsp), 8*3 +16(%rsp), 8*3 +24(%rsp)
+ ^
+<instantiation>:47:2: error: unknown use of instruction mnemonic without a size suffix
+ GHASH_4_ENCRYPT_4_PARALLEL_dec %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14, %xmm0, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7, %xmm8, enc
+ ^
+arch/x86/crypto/aesni-intel_asm.S:1599:2: note: while in macro instantiation
+ GCM_ENC_DEC dec
+ ^
+<instantiation>:15:74: error: too many positional arguments
+ PRECOMPUTE 8*3+8(%rsp), %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
+ ^
+arch/x86/crypto/aesni-intel_asm.S:1686:2: note: while in macro instantiation
+ GCM_INIT %r9, 8*3 +8(%rsp), 8*3 +16(%rsp), 8*3 +24(%rsp)
+ ^
+<instantiation>:47:2: error: unknown use of instruction mnemonic without a size suffix
+ GHASH_4_ENCRYPT_4_PARALLEL_enc %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14, %xmm0, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7, %xmm8, enc
+ ^
+arch/x86/crypto/aesni-intel_asm.S:1687:2: note: while in macro instantiation
+ GCM_ENC_DEC enc
+
+Craig Topper suggested me in ClangBuiltLinux issue #1050:
+
+> I think the "too many positional arguments" is because the parser isn't able
+> to handle the trailing commas.
+>
+> The "unknown use of instruction mnemonic" is because the macro was named
+> GHASH_4_ENCRYPT_4_PARALLEL_DEC but its being instantiated with
+> GHASH_4_ENCRYPT_4_PARALLEL_dec I guess gas ignores case on the
+> macro instantiation, but llvm doesn't.
+
+First, I removed the trailing comma in the PRECOMPUTE line.
+
+Second, I substituted:
+1. GHASH_4_ENCRYPT_4_PARALLEL_DEC -> GHASH_4_ENCRYPT_4_PARALLEL_dec
+2. GHASH_4_ENCRYPT_4_PARALLEL_ENC -> GHASH_4_ENCRYPT_4_PARALLEL_enc
+
+With these changes I was able to build with LLVM_IAS=1 and boot on bare metal.
+
+I confirmed that this works with Linux-kernel v5.7.5 final.
+
+NOTE: This patch is on top of Linux v5.7 final.
+
+Thanks to Craig and especially Nick for double-checking and his comments.
+
+Suggested-by: Craig Topper <craig.topper@intel.com>
+Suggested-by: Craig Topper <craig.topper@gmail.com>
+Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Cc: "ClangBuiltLinux" <clang-built-linux@googlegroups.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1050
+Link: https://bugs.llvm.org/show_bug.cgi?id=24494
+Signed-off-by: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/crypto/aesni-intel_asm.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
+index 54e7d15dbd0d5..7d4298e6d4cbd 100644
+--- a/arch/x86/crypto/aesni-intel_asm.S
++++ b/arch/x86/crypto/aesni-intel_asm.S
+@@ -266,7 +266,7 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff
+ PSHUFB_XMM %xmm2, %xmm0
+ movdqu %xmm0, CurCount(%arg2) # ctx_data.current_counter = iv
+
+- PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
++ PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7
+ movdqu HashKey(%arg2), %xmm13
+
+ CALC_AAD_HASH %xmm13, \AAD, \AADLEN, %xmm0, %xmm1, %xmm2, %xmm3, \
+@@ -978,7 +978,7 @@ _initial_blocks_done\@:
+ * arg1, %arg3, %arg4 are used as pointers only, not modified
+ * %r11 is the data offset value
+ */
+-.macro GHASH_4_ENCRYPT_4_PARALLEL_ENC TMP1 TMP2 TMP3 TMP4 TMP5 \
++.macro GHASH_4_ENCRYPT_4_PARALLEL_enc TMP1 TMP2 TMP3 TMP4 TMP5 \
+ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+
+ movdqa \XMM1, \XMM5
+@@ -1186,7 +1186,7 @@ aes_loop_par_enc_done\@:
+ * arg1, %arg3, %arg4 are used as pointers only, not modified
+ * %r11 is the data offset value
+ */
+-.macro GHASH_4_ENCRYPT_4_PARALLEL_DEC TMP1 TMP2 TMP3 TMP4 TMP5 \
++.macro GHASH_4_ENCRYPT_4_PARALLEL_dec TMP1 TMP2 TMP3 TMP4 TMP5 \
+ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+
+ movdqa \XMM1, \XMM5
+--
+2.25.1
+
--- /dev/null
+From cf87ac859ab2e24a90f81edd12e82567e9989ea3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 15:14:55 +0300
+Subject: crypto: caam - silence .setkey in case of bad key length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Horia Geantă <horia.geanta@nxp.com>
+
+[ Upstream commit da6a66853a381864f4b040832cf11f0dbba0a097 ]
+
+In case of bad key length, driver emits "key size mismatch" messages,
+but only for xts(aes) algorithms.
+
+Reduce verbosity by making them visible only when debugging.
+This way crypto fuzz testing log cleans up a bit.
+
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamalg.c | 2 +-
+ drivers/crypto/caam/caamalg_qi.c | 2 +-
+ drivers/crypto/caam/caamalg_qi2.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index b2f9882bc010f..bf90a4fcabd1f 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -838,7 +838,7 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
+ u32 *desc;
+
+ if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
+- dev_err(jrdev, "key size mismatch\n");
++ dev_dbg(jrdev, "key size mismatch\n");
+ return -EINVAL;
+ }
+
+diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
+index 27e36bdf6163b..315d53499ce85 100644
+--- a/drivers/crypto/caam/caamalg_qi.c
++++ b/drivers/crypto/caam/caamalg_qi.c
+@@ -728,7 +728,7 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
+ int ret = 0;
+
+ if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
+- dev_err(jrdev, "key size mismatch\n");
++ dev_dbg(jrdev, "key size mismatch\n");
+ return -EINVAL;
+ }
+
+diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
+index 28669cbecf77c..e1b6bc6ef091b 100644
+--- a/drivers/crypto/caam/caamalg_qi2.c
++++ b/drivers/crypto/caam/caamalg_qi2.c
+@@ -1058,7 +1058,7 @@ static int xts_skcipher_setkey(struct crypto_skcipher *skcipher, const u8 *key,
+ u32 *desc;
+
+ if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
+- dev_err(dev, "key size mismatch\n");
++ dev_dbg(dev, "key size mismatch\n");
+ return -EINVAL;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From fb92a5c24c651f5f5e780a285bfaf039c9df7a19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jun 2020 14:19:57 +0300
+Subject: crypto: ccree - fix resource leak on error path
+
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+
+[ Upstream commit 9bc6165d608d676f05d8bf156a2c9923ee38d05b ]
+
+Fix a small resource leak on the error path of cipher processing.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Fixes: 63ee04c8b491e ("crypto: ccree - add skcipher support")
+Cc: Markus Elfring <Markus.Elfring@web.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccree/cc_cipher.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
+index 872ea3ff1c6ba..f144fe04748b0 100644
+--- a/drivers/crypto/ccree/cc_cipher.c
++++ b/drivers/crypto/ccree/cc_cipher.c
+@@ -159,7 +159,6 @@ static int cc_cipher_init(struct crypto_tfm *tfm)
+ skcipher_alg.base);
+ struct device *dev = drvdata_to_dev(cc_alg->drvdata);
+ unsigned int max_key_buf_size = cc_alg->skcipher_alg.max_keysize;
+- int rc = 0;
+
+ dev_dbg(dev, "Initializing context @%p for %s\n", ctx_p,
+ crypto_tfm_alg_name(tfm));
+@@ -171,10 +170,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm)
+ ctx_p->flow_mode = cc_alg->flow_mode;
+ ctx_p->drvdata = cc_alg->drvdata;
+
++ if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) {
++ /* Alloc hash tfm for essiv */
++ ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0);
++ if (IS_ERR(ctx_p->shash_tfm)) {
++ dev_err(dev, "Error allocating hash tfm for ESSIV.\n");
++ return PTR_ERR(ctx_p->shash_tfm);
++ }
++ }
++
+ /* Allocate key buffer, cache line aligned */
+ ctx_p->user.key = kmalloc(max_key_buf_size, GFP_KERNEL);
+ if (!ctx_p->user.key)
+- return -ENOMEM;
++ goto free_shash;
+
+ dev_dbg(dev, "Allocated key buffer in context. key=@%p\n",
+ ctx_p->user.key);
+@@ -186,21 +194,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm)
+ if (dma_mapping_error(dev, ctx_p->user.key_dma_addr)) {
+ dev_err(dev, "Mapping Key %u B at va=%pK for DMA failed\n",
+ max_key_buf_size, ctx_p->user.key);
+- return -ENOMEM;
++ goto free_key;
+ }
+ dev_dbg(dev, "Mapped key %u B at va=%pK to dma=%pad\n",
+ max_key_buf_size, ctx_p->user.key, &ctx_p->user.key_dma_addr);
+
+- if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) {
+- /* Alloc hash tfm for essiv */
+- ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0);
+- if (IS_ERR(ctx_p->shash_tfm)) {
+- dev_err(dev, "Error allocating hash tfm for ESSIV.\n");
+- return PTR_ERR(ctx_p->shash_tfm);
+- }
+- }
++ return 0;
+
+- return rc;
++free_key:
++ kfree(ctx_p->user.key);
++free_shash:
++ crypto_free_shash(ctx_p->shash_tfm);
++
++ return -ENOMEM;
+ }
+
+ static void cc_cipher_exit(struct crypto_tfm *tfm)
+--
+2.25.1
+
--- /dev/null
+From d1eae0527b0f7a0b6fe2bd434e186e637281b7b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 18:16:17 +0100
+Subject: crypto: qat - allow xts requests not multiple of block
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 528f776df67c440361b2847b4da400d8754bf030 ]
+
+Allow AES-XTS requests that are not multiple of the block size.
+If a request is smaller than the block size, return -EINVAL.
+
+This fixes the following issue reported by the crypto testmgr self-test:
+
+ alg: skcipher: qat_aes_xts encryption failed on test vector "random: len=116 klen=64"; expected_error=0, actual_error=-22, cfg="random: inplace may_sleep use_finup src_divs=[<reimport>45.85%@+4077, <flush>54.15%@alignmask+18]"
+
+Fixes: 96ee111a659e ("crypto: qat - return error for block...")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_algs.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index e14d3dd291f09..1b050391c0c90 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -55,6 +55,7 @@
+ #include <crypto/hmac.h>
+ #include <crypto/algapi.h>
+ #include <crypto/authenc.h>
++#include <crypto/xts.h>
+ #include <linux/dma-mapping.h>
+ #include "adf_accel_devices.h"
+ #include "adf_transport.h"
+@@ -1102,6 +1103,14 @@ static int qat_alg_skcipher_blk_encrypt(struct skcipher_request *req)
+ return qat_alg_skcipher_encrypt(req);
+ }
+
++static int qat_alg_skcipher_xts_encrypt(struct skcipher_request *req)
++{
++ if (req->cryptlen < XTS_BLOCK_SIZE)
++ return -EINVAL;
++
++ return qat_alg_skcipher_encrypt(req);
++}
++
+ static int qat_alg_skcipher_decrypt(struct skcipher_request *req)
+ {
+ struct crypto_skcipher *stfm = crypto_skcipher_reqtfm(req);
+@@ -1161,6 +1170,15 @@ static int qat_alg_skcipher_blk_decrypt(struct skcipher_request *req)
+
+ return qat_alg_skcipher_decrypt(req);
+ }
++
++static int qat_alg_skcipher_xts_decrypt(struct skcipher_request *req)
++{
++ if (req->cryptlen < XTS_BLOCK_SIZE)
++ return -EINVAL;
++
++ return qat_alg_skcipher_decrypt(req);
++}
++
+ static int qat_alg_aead_init(struct crypto_aead *tfm,
+ enum icp_qat_hw_auth_algo hash,
+ const char *hash_name)
+@@ -1354,8 +1372,8 @@ static struct skcipher_alg qat_skciphers[] = { {
+ .init = qat_alg_skcipher_init_tfm,
+ .exit = qat_alg_skcipher_exit_tfm,
+ .setkey = qat_alg_skcipher_xts_setkey,
+- .decrypt = qat_alg_skcipher_blk_decrypt,
+- .encrypt = qat_alg_skcipher_blk_encrypt,
++ .decrypt = qat_alg_skcipher_xts_decrypt,
++ .encrypt = qat_alg_skcipher_xts_encrypt,
+ .min_keysize = 2 * AES_MIN_KEY_SIZE,
+ .max_keysize = 2 * AES_MAX_KEY_SIZE,
+ .ivsize = AES_BLOCK_SIZE,
+--
+2.25.1
+
--- /dev/null
+From dffff93beea4d619f94060000b6740fcbd3c44aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:17:40 +0200
+Subject: crypto: x86/crc32c - fix building with clang ias
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 44623b2818f4a442726639572f44fd9b6d0ef68c ]
+
+The clang integrated assembler complains about movzxw:
+
+arch/x86/crypto/crc32c-pcl-intel-asm_64.S:173:2: error: invalid instruction mnemonic 'movzxw'
+
+It seems that movzwq is the mnemonic that it expects instead,
+and this is what objdump prints when disassembling the file.
+
+Fixes: 6a8ce1ef3940 ("crypto: crc32c - Optimize CRC32C calculation with PCLMULQDQ instruction")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+index 8501ec4532f4f..442599cbe7960 100644
+--- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
++++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+@@ -170,7 +170,7 @@ continue_block:
+
+ ## branch into array
+ lea jump_table(%rip), %bufp
+- movzxw (%bufp, %rax, 2), len
++ movzwq (%bufp, %rax, 2), len
+ lea crc_array(%rip), %bufp
+ lea (%bufp, len, 1), %bufp
+ JMP_NOSPEC bufp
+--
+2.25.1
+
--- /dev/null
+From f0ac9bb9847fe61abe33f4c70c4f6b8cdc2e7adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jun 2020 20:07:33 +0800
+Subject: cxl: Fix kobject memleak
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 85c5cbeba8f4fb28e6b9bfb3e467718385f78f76 ]
+
+Currently the error return path from kobject_init_and_add() is not
+followed by a call to kobject_put() - which means we are leaking
+the kobject.
+
+Fix it by adding a call to kobject_put() in the error path of
+kobject_init_and_add().
+
+Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Andrew Donnellan <ajd@linux.ibm.com>
+Acked-by: Frederic Barrat <fbarrat@linux.ibm.com>
+Link: https://lore.kernel.org/r/20200602120733.5943-1-wanghai38@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/cxl/sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
+index f0263d1a1fdf2..d97a243ad30c0 100644
+--- a/drivers/misc/cxl/sysfs.c
++++ b/drivers/misc/cxl/sysfs.c
+@@ -624,7 +624,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c
+ rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type,
+ &afu->dev.kobj, "cr%i", cr->cr);
+ if (rc)
+- goto err;
++ goto err1;
+
+ rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr);
+ if (rc)
+--
+2.25.1
+
--- /dev/null
+From eeb69b2c77c045977741fd1034d19b09873db323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 11:25:33 +0800
+Subject: dlm: Fix kobject memleak
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 0ffddafc3a3970ef7013696e7f36b3d378bc4c16 ]
+
+Currently the error return path from kobject_init_and_add() is not
+followed by a call to kobject_put() - which means we are leaking
+the kobject.
+
+Set do_unreg = 1 before kobject_init_and_add() to ensure that
+kobject_put() can be called in its error patch.
+
+Fixes: 901195ed7f4b ("Kobject: change GFS2 to use kobject_init_and_add")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lockspace.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index e93670ecfae5b..624617c12250a 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -622,6 +622,9 @@ static int new_lockspace(const char *name, const char *cluster,
+ wait_event(ls->ls_recover_lock_wait,
+ test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags));
+
++ /* let kobject handle freeing of ls if there's an error */
++ do_unreg = 1;
++
+ ls->ls_kobj.kset = dlm_kset;
+ error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL,
+ "%s", ls->ls_name);
+@@ -629,9 +632,6 @@ static int new_lockspace(const char *name, const char *cluster,
+ goto out_recoverd;
+ kobject_uevent(&ls->ls_kobj, KOBJ_ADD);
+
+- /* let kobject handle freeing of ls if there's an error */
+- do_unreg = 1;
+-
+ /* This uevent triggers dlm_controld in userspace to add us to the
+ group of nodes that are members of this lockspace (managed by the
+ cluster infrastructure.) Once it's done that, it tells us who the
+--
+2.25.1
+
--- /dev/null
+From 53451cb1b8d042e3d422f58e4033322967023fd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 15:34:43 +0300
+Subject: dma-buf: fix dma-fence-chain out of order test
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+
+[ Upstream commit 4cca2e641641767593583749dec26bfebd8f6f2d ]
+
+There was probably a misunderstand on how the dma-fence-chain is
+supposed to work or what dma_fence_chain_find_seqno() is supposed to
+return.
+
+dma_fence_chain_find_seqno() is here to give us the fence to wait upon
+for a particular point in the timeline. The timeline progresses only
+when all the points prior to a given number have completed.
+
+Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Fixes: dc2f7e67a28a5c ("dma-buf: Exercise dma-fence-chain under selftests")
+Link: https://patchwork.freedesktop.org/patch/372960/
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/st-dma-fence-chain.c | 43 ++++++++++++++--------------
+ 1 file changed, 21 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
+index 5d45ba7ba3cd3..9525f7f561194 100644
+--- a/drivers/dma-buf/st-dma-fence-chain.c
++++ b/drivers/dma-buf/st-dma-fence-chain.c
+@@ -318,15 +318,16 @@ static int find_out_of_order(void *arg)
+ goto err;
+ }
+
+- if (fence && fence != fc.chains[1]) {
++ /*
++ * We signaled the middle fence (2) of the 1-2-3 chain. The behavior
++ * of the dma-fence-chain is to make us wait for all the fences up to
++ * the point we want. Since fence 1 is still not signaled, this what
++ * we should get as fence to wait upon (fence 2 being garbage
++ * collected during the traversal of the chain).
++ */
++ if (fence != fc.chains[0]) {
+ pr_err("Incorrect chain-fence.seqno:%lld reported for completed seqno:2\n",
+- fence->seqno);
+-
+- dma_fence_get(fence);
+- err = dma_fence_chain_find_seqno(&fence, 2);
+- dma_fence_put(fence);
+- if (err)
+- pr_err("Reported %d for finding self!\n", err);
++ fence ? fence->seqno : 0);
+
+ err = -EINVAL;
+ }
+@@ -415,20 +416,18 @@ static int __find_race(void *arg)
+ if (!fence)
+ goto signal;
+
+- err = dma_fence_chain_find_seqno(&fence, seqno);
+- if (err) {
+- pr_err("Reported an invalid fence for find-self:%d\n",
+- seqno);
+- dma_fence_put(fence);
+- break;
+- }
+-
+- if (fence->seqno < seqno) {
+- pr_err("Reported an earlier fence.seqno:%lld for seqno:%d\n",
+- fence->seqno, seqno);
+- err = -EINVAL;
+- dma_fence_put(fence);
+- break;
++ /*
++ * We can only find ourselves if we are on fence we were
++ * looking for.
++ */
++ if (fence->seqno == seqno) {
++ err = dma_fence_chain_find_seqno(&fence, seqno);
++ if (err) {
++ pr_err("Reported an invalid fence for find-self:%d\n",
++ seqno);
++ dma_fence_put(fence);
++ break;
++ }
+ }
+
+ dma_fence_put(fence);
+--
+2.25.1
+
--- /dev/null
+From 2079cf9ec48584f5bdb3571a0717a22f153c55e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 14:34:19 +0300
+Subject: dpaa2-eth: fix condition for number of buffer acquire retries
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit 0e5ad75b02d9341eb9ca22627247f9a02cc20d6f ]
+
+We should keep retrying to acquire buffers through the software portals
+as long as the function returns -EBUSY and the number of retries is
+__below__ DPAA2_ETH_SWP_BUSY_RETRIES.
+
+Fixes: ef17bd7cc0c8 ("dpaa2-eth: Avoid unbounded while loops")
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index 0998ceb1a26ea..89c43401f2889 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -1109,7 +1109,7 @@ static void drain_bufs(struct dpaa2_eth_priv *priv, int count)
+ buf_array, count);
+ if (ret < 0) {
+ if (ret == -EBUSY &&
+- retries++ >= DPAA2_ETH_SWP_BUSY_RETRIES)
++ retries++ < DPAA2_ETH_SWP_BUSY_RETRIES)
+ continue;
+ netdev_err(priv->net_dev, "dpaa2_io_service_acquire() failed\n");
+ return;
+--
+2.25.1
+
--- /dev/null
+From a93d74efa9d7a5c799875048dee86ff65a992ca5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 21:26:43 +0800
+Subject: dpaa2-eth: Fix passing zero to 'PTR_ERR' warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 02afa9c66bb954c6959877c70d9e128dcf0adce7 ]
+
+Fix smatch warning:
+
+drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c:2419
+ alloc_channel() warn: passing zero to 'ERR_PTR'
+
+setup_dpcon() should return ERR_PTR(err) instead of zero in error
+handling case.
+
+Fixes: d7f5a9d89a55 ("dpaa2-eth: defer probe on object allocate")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index 89c43401f2889..a4b2b18009c1d 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -2207,7 +2207,7 @@ static struct fsl_mc_device *setup_dpcon(struct dpaa2_eth_priv *priv)
+ free:
+ fsl_mc_object_free(dpcon);
+
+- return NULL;
++ return ERR_PTR(err);
+ }
+
+ static void free_dpcon(struct dpaa2_eth_priv *priv,
+@@ -2231,8 +2231,8 @@ alloc_channel(struct dpaa2_eth_priv *priv)
+ return NULL;
+
+ channel->dpcon = setup_dpcon(priv);
+- if (IS_ERR_OR_NULL(channel->dpcon)) {
+- err = PTR_ERR_OR_ZERO(channel->dpcon);
++ if (IS_ERR(channel->dpcon)) {
++ err = PTR_ERR(channel->dpcon);
+ goto err_setup;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From d2928d9eeef5479bcfb349e7a4c70fec9098e8d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jun 2020 15:16:00 -0400
+Subject: drm/amd/display: allow query ddc data over aux to be read only
+ operation
+
+From: Wenjing Liu <wenjing.liu@amd.com>
+
+[ Upstream commit 26b4750d6cf84cb2b3f0a84c9b345e7b71886410 ]
+
+[why]
+Two issues:
+1. Add read only operation support for query ddc data over aux.
+2. Fix a bug where if read size is multiple of 16,
+mot of the last read transaction will not be set to 0.
+
+Signed-off-by: Wenjing Liu <wenjing.liu@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/core/dc_link_ddc.c | 29 ++++++++++++-------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+index aefd29a440b52..be8f265976b09 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+@@ -503,7 +503,7 @@ bool dal_ddc_service_query_ddc_data(
+ uint8_t *read_buf,
+ uint32_t read_size)
+ {
+- bool ret = false;
++ bool success = true;
+ uint32_t payload_size =
+ dal_ddc_service_is_in_aux_transaction_mode(ddc) ?
+ DEFAULT_AUX_MAX_DATA_SIZE : EDID_SEGMENT_SIZE;
+@@ -527,7 +527,6 @@ bool dal_ddc_service_query_ddc_data(
+ * but we want to read 256 over i2c!!!!*/
+ if (dal_ddc_service_is_in_aux_transaction_mode(ddc)) {
+ struct aux_payload payload;
+- bool read_available = true;
+
+ payload.i2c_over_aux = true;
+ payload.address = address;
+@@ -536,21 +535,26 @@ bool dal_ddc_service_query_ddc_data(
+
+ if (write_size != 0) {
+ payload.write = true;
+- payload.mot = false;
++ /* should not set mot (middle of transaction) to 0
++ * if there are pending read payloads
++ */
++ payload.mot = read_size == 0 ? false : true;
+ payload.length = write_size;
+ payload.data = write_buf;
+
+- ret = dal_ddc_submit_aux_command(ddc, &payload);
+- read_available = ret;
++ success = dal_ddc_submit_aux_command(ddc, &payload);
+ }
+
+- if (read_size != 0 && read_available) {
++ if (read_size != 0 && success) {
+ payload.write = false;
++ /* should set mot (middle of transaction) to 0
++ * since it is the last payload to send
++ */
+ payload.mot = false;
+ payload.length = read_size;
+ payload.data = read_buf;
+
+- ret = dal_ddc_submit_aux_command(ddc, &payload);
++ success = dal_ddc_submit_aux_command(ddc, &payload);
+ }
+ } else {
+ struct i2c_command command = {0};
+@@ -573,7 +577,7 @@ bool dal_ddc_service_query_ddc_data(
+ command.number_of_payloads =
+ dal_ddc_i2c_payloads_get_count(&payloads);
+
+- ret = dm_helpers_submit_i2c(
++ success = dm_helpers_submit_i2c(
+ ddc->ctx,
+ ddc->link,
+ &command);
+@@ -581,7 +585,7 @@ bool dal_ddc_service_query_ddc_data(
+ dal_ddc_i2c_payloads_destroy(&payloads);
+ }
+
+- return ret;
++ return success;
+ }
+
+ bool dal_ddc_submit_aux_command(struct ddc_service *ddc,
+@@ -598,7 +602,7 @@ bool dal_ddc_submit_aux_command(struct ddc_service *ddc,
+
+ do {
+ struct aux_payload current_payload;
+- bool is_end_of_payload = (retrieved + DEFAULT_AUX_MAX_DATA_SIZE) >
++ bool is_end_of_payload = (retrieved + DEFAULT_AUX_MAX_DATA_SIZE) >=
+ payload->length;
+
+ current_payload.address = payload->address;
+@@ -607,7 +611,10 @@ bool dal_ddc_submit_aux_command(struct ddc_service *ddc,
+ current_payload.i2c_over_aux = payload->i2c_over_aux;
+ current_payload.length = is_end_of_payload ?
+ payload->length - retrieved : DEFAULT_AUX_MAX_DATA_SIZE;
+- current_payload.mot = !is_end_of_payload;
++ /* set mot (middle of transaction) to false
++ * if it is the last payload
++ */
++ current_payload.mot = is_end_of_payload ? payload->mot:true;
+ current_payload.reply = payload->reply;
+ current_payload.write = payload->write;
+
+--
+2.25.1
+
--- /dev/null
+From 40f10bc58640d747b68422d624fdff1486a40685 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 13:56:53 -0400
+Subject: drm/amd/display: Improve DisplayPort monitor interop
+
+From: Aric Cyr <aric.cyr@amd.com>
+
+[ Upstream commit eec3303de3378cdfaa0bb86f43546dbbd88f94e2 ]
+
+[Why]
+DC is very fast at link training and stream enablement
+which causes issues such as blackscreens for non-compliant
+monitors.
+
+[How]
+After debugging with scaler vendors we implement the
+minimum delays at the necessary locations to ensure
+the monitor does not hang. Delays are generic due to
+lack of IEEE OUI information on the failing displays.
+
+Signed-off-by: Aric Cyr <aric.cyr@amd.com>
+Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Acked-by: Tony Cheng <Tony.Cheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 4 +++-
+ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 16 ++++++++++------
+ .../amd/display/dc/dce110/dce110_hw_sequencer.c | 11 ++++++++++-
+ 3 files changed, 23 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 48ab51533d5d6..841cc051b7d01 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -3298,9 +3298,11 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx)
+ write_i2c_redriver_setting(pipe_ctx, false);
+ }
+ }
+- dc->hwss.disable_stream(pipe_ctx);
+
+ disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
++
++ dc->hwss.disable_stream(pipe_ctx);
++
+ if (pipe_ctx->stream->timing.flags.DSC) {
+ if (dc_is_dp_signal(pipe_ctx->stream->signal))
+ dp_set_dsc_enable(pipe_ctx, false);
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index 91cd884d6f257..6124af571bff6 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -1102,6 +1102,10 @@ static inline enum link_training_result perform_link_training_int(
+ dpcd_pattern.v1_4.TRAINING_PATTERN_SET = DPCD_TRAINING_PATTERN_VIDEOIDLE;
+ dpcd_set_training_pattern(link, dpcd_pattern);
+
++ /* delay 5ms after notifying sink of idle pattern before switching output */
++ if (link->connector_signal != SIGNAL_TYPE_EDP)
++ msleep(5);
++
+ /* 4. mainlink output idle pattern*/
+ dp_set_hw_test_pattern(link, DP_TEST_PATTERN_VIDEO_MODE, NULL, 0);
+
+@@ -1551,6 +1555,12 @@ bool perform_link_training_with_retries(
+ struct dc_link *link = stream->link;
+ enum dp_panel_mode panel_mode = dp_get_panel_mode(link);
+
++ /* We need to do this before the link training to ensure the idle pattern in SST
++ * mode will be sent right after the link training
++ */
++ link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
++ pipe_ctx->stream_res.stream_enc->id, true);
++
+ for (j = 0; j < attempts; ++j) {
+
+ dp_enable_link_phy(
+@@ -1567,12 +1577,6 @@ bool perform_link_training_with_retries(
+
+ dp_set_panel_mode(link, panel_mode);
+
+- /* We need to do this before the link training to ensure the idle pattern in SST
+- * mode will be sent right after the link training
+- */
+- link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
+- pipe_ctx->stream_res.stream_enc->id, true);
+-
+ if (link->aux_access_disabled) {
+ dc_link_dp_perform_link_training_skip_aux(link, link_setting);
+ return true;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index b77e9dc160863..2af1d74d16ad8 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -1069,8 +1069,17 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx)
+ link->dc->hwss.set_abm_immediate_disable(pipe_ctx);
+ }
+
+- if (dc_is_dp_signal(pipe_ctx->stream->signal))
++ if (dc_is_dp_signal(pipe_ctx->stream->signal)) {
+ pipe_ctx->stream_res.stream_enc->funcs->dp_blank(pipe_ctx->stream_res.stream_enc);
++
++ /*
++ * After output is idle pattern some sinks need time to recognize the stream
++ * has changed or they enter protection state and hang.
++ */
++ if (!dc_is_embedded_signal(pipe_ctx->stream->signal))
++ msleep(60);
++ }
++
+ }
+
+
+--
+2.25.1
+
--- /dev/null
+From 18a10f5878c537ed285a65c32a6bbf6c9da467f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jun 2020 19:12:42 +0800
+Subject: drm/amd/powerplay: fix compile error with ARCH=arc
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 9822ba2ead1baa3de4860ad9472f652c4cc78c9c ]
+
+Fix the compile error below:
+drivers/gpu/drm/amd/amdgpu/../powerplay/smu_v11_0.c: In function 'smu_v11_0_init_microcode':
+>> arch/arc/include/asm/bug.h:22:2: error: implicit declaration of function 'pr_warn'; did you mean 'pci_warn'? [-Werror=implicit-function-declaration]
+ 22 | pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
+ | ^~~~~~~
+drivers/gpu/drm/amd/amdgpu/../powerplay/smu_v11_0.c:176:3: note: in expansion of macro 'BUG'
+ 176 | BUG();
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/smu_v11_0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
+index aa76c2cea7471..7897be877b961 100644
+--- a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
++++ b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
+@@ -164,7 +164,8 @@ int smu_v11_0_init_microcode(struct smu_context *smu)
+ chip_name = "navi12";
+ break;
+ default:
+- BUG();
++ dev_err(adev->dev, "Unsupported ASIC type %d\n", adev->asic_type);
++ return -EINVAL;
+ }
+
+ snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_smc.bin", chip_name);
+--
+2.25.1
+
--- /dev/null
+From b86d862c38794f6c09ead56bb156acb6a1dcc05e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 14:01:29 +0800
+Subject: drm/amd/powerplay: suppress compile error around BUG_ON
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 75bc07e2403caea9ecac69f766dfb7dc33547594 ]
+
+To suppress the compile error below for "ARCH=arc".
+ drivers/gpu/drm/amd/amdgpu/../powerplay/arcturus_ppt.c: In function 'arcturus_fill_eeprom_i2c_req':
+>> arch/arc/include/asm/bug.h:22:2: error: implicit declaration of function 'pr_warn'; did you mean 'pci_warn'? [-Werror=implicit-function-declaration]
+ 22 | pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
+ | ^~~~~~~
+ include/asm-generic/bug.h:62:57: note: in expansion of macro 'BUG'
+ 62 | #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
+ | ^~~
+ drivers/gpu/drm/amd/amdgpu/../powerplay/arcturus_ppt.c:2157:2: note: in expansion of macro 'BUG_ON'
+ 2157 | BUG_ON(numbytes > MAX_SW_I2C_COMMANDS);
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/arcturus_ppt.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
+index 27c5fc9572b27..e4630a76d7bf5 100644
+--- a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
+@@ -2042,8 +2042,6 @@ static void arcturus_fill_eeprom_i2c_req(SwI2cRequest_t *req, bool write,
+ {
+ int i;
+
+- BUG_ON(numbytes > MAX_SW_I2C_COMMANDS);
+-
+ req->I2CcontrollerPort = 0;
+ req->I2CSpeed = 2;
+ req->SlaveAddress = address;
+@@ -2081,6 +2079,12 @@ static int arcturus_i2c_eeprom_read_data(struct i2c_adapter *control,
+ struct smu_table_context *smu_table = &adev->smu.smu_table;
+ struct smu_table *table = &smu_table->driver_table;
+
++ if (numbytes > MAX_SW_I2C_COMMANDS) {
++ dev_err(adev->dev, "numbytes requested %d is over max allowed %d\n",
++ numbytes, MAX_SW_I2C_COMMANDS);
++ return -EINVAL;
++ }
++
+ memset(&req, 0, sizeof(req));
+ arcturus_fill_eeprom_i2c_req(&req, false, address, numbytes, data);
+
+@@ -2117,6 +2121,12 @@ static int arcturus_i2c_eeprom_write_data(struct i2c_adapter *control,
+ SwI2cRequest_t req;
+ struct amdgpu_device *adev = to_amdgpu_device(control);
+
++ if (numbytes > MAX_SW_I2C_COMMANDS) {
++ dev_err(adev->dev, "numbytes requested %d is over max allowed %d\n",
++ numbytes, MAX_SW_I2C_COMMANDS);
++ return -EINVAL;
++ }
++
+ memset(&req, 0, sizeof(req));
+ arcturus_fill_eeprom_i2c_req(&req, true, address, numbytes, data);
+
+--
+2.25.1
+
--- /dev/null
+From 85a7a11a1226f5bdc38c7dc1d50b98ae28fe3949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jun 2019 16:30:13 +0800
+Subject: drm/amdgpu: avoid dereferencing a NULL pointer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 55611b507fd6453d26030c0c0619fdf0c262766d ]
+
+Check if irq_src is NULL to avoid dereferencing a NULL pointer,
+for MES ring is uneccessary to recieve an interrupt notification.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index d878fe7fee51c..3414e119f0cbf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -416,7 +416,9 @@ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
+ ring->fence_drv.gpu_addr = adev->uvd.inst[ring->me].gpu_addr + index;
+ }
+ amdgpu_fence_write(ring, atomic_read(&ring->fence_drv.last_seq));
+- amdgpu_irq_get(adev, irq_src, irq_type);
++
++ if (irq_src)
++ amdgpu_irq_get(adev, irq_src, irq_type);
+
+ ring->fence_drv.irq_src = irq_src;
+ ring->fence_drv.irq_type = irq_type;
+@@ -537,8 +539,9 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
+ /* no need to trigger GPU reset as we are unloading */
+ amdgpu_fence_driver_force_completion(ring);
+ }
+- amdgpu_irq_put(adev, ring->fence_drv.irq_src,
+- ring->fence_drv.irq_type);
++ if (ring->fence_drv.irq_src)
++ amdgpu_irq_put(adev, ring->fence_drv.irq_src,
++ ring->fence_drv.irq_type);
+ drm_sched_fini(&ring->sched);
+ del_timer_sync(&ring->fence_drv.fallback_timer);
+ for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j)
+@@ -574,8 +577,9 @@ void amdgpu_fence_driver_suspend(struct amdgpu_device *adev)
+ }
+
+ /* disable the interrupt */
+- amdgpu_irq_put(adev, ring->fence_drv.irq_src,
+- ring->fence_drv.irq_type);
++ if (ring->fence_drv.irq_src)
++ amdgpu_irq_put(adev, ring->fence_drv.irq_src,
++ ring->fence_drv.irq_type);
+ }
+ }
+
+@@ -601,8 +605,9 @@ void amdgpu_fence_driver_resume(struct amdgpu_device *adev)
+ continue;
+
+ /* enable the interrupt */
+- amdgpu_irq_get(adev, ring->fence_drv.irq_src,
+- ring->fence_drv.irq_type);
++ if (ring->fence_drv.irq_src)
++ amdgpu_irq_get(adev, ring->fence_drv.irq_src,
++ ring->fence_drv.irq_type);
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 527e156c7517c5e7c0590aaf1d29291ff0968426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 18:51:30 +0800
+Subject: drm/amdgpu/debugfs: fix memory leak when
+ amdgpu_virt_enable_access_debugfs failed
+
+From: Chen Tao <chentao107@huawei.com>
+
+[ Upstream commit 888e32d71115e26b57bdcbc717c68e9c5026bac3 ]
+
+Fix memory leak in amdgpu_debugfs_gpr_read not freeing data when
+amdgpu_virt_enable_access_debugfs failed.
+
+Fixes: 95a2f917387a2 ("drm/amdgpu: restrict debugfs register access under SR-IOV")
+Signed-off-by: Chen Tao <chentao107@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 386b979e08522..f87b225437fc3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -977,7 +977,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+ if (r < 0)
+- return r;
++ goto err;
+
+ /* switch to the specific se/sh/cu */
+ mutex_lock(&adev->grbm_idx_mutex);
+--
+2.25.1
+
--- /dev/null
+From 1dc32bd4f55b70c3664ebfe0a23f2c0acea0a654 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 14:30:17 -0400
+Subject: drm/amdgpu/debugfs: fix ref count leak when pm_runtime_get_sync fails
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 ]
+
+The call to pm_runtime_get_sync increments the counter even in case of
+failure, leading to incorrect ref count.
+In case of failure, decrement the ref count before returning.
+
+Acked-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 95 +++++++++++++++------
+ 1 file changed, 70 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index a414da22a359c..386b979e08522 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -223,12 +223,16 @@ static int amdgpu_debugfs_process_reg_op(bool read, struct file *f,
+ *pos &= (1UL << 22) - 1;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ if (use_bank) {
+ if ((sh_bank != 0xFFFFFFFF && sh_bank >= adev->gfx.config.max_sh_per_se) ||
+@@ -332,12 +336,16 @@ static ssize_t amdgpu_debugfs_regs_pcie_read(struct file *f, char __user *buf,
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ while (size) {
+ uint32_t value;
+@@ -387,12 +395,16 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ while (size) {
+ uint32_t value;
+@@ -443,12 +455,16 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf,
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ while (size) {
+ uint32_t value;
+@@ -498,12 +514,16 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ while (size) {
+ uint32_t value;
+@@ -554,12 +574,16 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ while (size) {
+ uint32_t value;
+@@ -609,12 +633,16 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user *
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ while (size) {
+ uint32_t value;
+@@ -764,12 +792,16 @@ static ssize_t amdgpu_debugfs_sensor_read(struct file *f, char __user *buf,
+ valuesize = sizeof(values);
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_dpm_read_sensor(adev, idx, &values[0], &valuesize);
+
+@@ -842,12 +874,16 @@ static ssize_t amdgpu_debugfs_wave_read(struct file *f, char __user *buf,
+ simd = (*pos & GENMASK_ULL(44, 37)) >> 37;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ /* switch to the specific se/sh/cu */
+ mutex_lock(&adev->grbm_idx_mutex);
+@@ -977,6 +1013,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ }
+
+ err:
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ kfree(data);
+ amdgpu_virt_disable_access_debugfs(adev);
+ return result;
+@@ -1003,8 +1040,10 @@ static ssize_t amdgpu_debugfs_gfxoff_write(struct file *f, const char __user *bu
+ return -EINVAL;
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ while (size) {
+ uint32_t value;
+@@ -1140,8 +1179,10 @@ static int amdgpu_debugfs_test_ib(struct seq_file *m, void *data)
+ int r = 0, i;
+
+ r = pm_runtime_get_sync(dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ /* Avoid accidently unparking the sched thread during GPU reset */
+ mutex_lock(&adev->lock_reset);
+@@ -1197,8 +1238,10 @@ static int amdgpu_debugfs_evict_vram(struct seq_file *m, void *data)
+ int r;
+
+ r = pm_runtime_get_sync(dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ seq_printf(m, "(%d)\n", amdgpu_bo_evict_vram(adev));
+
+@@ -1216,8 +1259,10 @@ static int amdgpu_debugfs_evict_gtt(struct seq_file *m, void *data)
+ int r;
+
+ r = pm_runtime_get_sync(dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return r;
++ }
+
+ seq_printf(m, "(%d)\n", ttm_bo_evict_mm(&adev->mman.bdev, TTM_PL_TT));
+
+@@ -1417,16 +1462,16 @@ static int amdgpu_debugfs_sclk_set(void *data, u64 val)
+ return -EINVAL;
+
+ ret = pm_runtime_get_sync(adev->ddev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(adev->ddev->dev);
+ return ret;
++ }
+
+ if (is_support_sw_smu(adev)) {
+ ret = smu_get_dpm_freq_range(&adev->smu, SMU_SCLK, &min_freq, &max_freq, true);
+ if (ret || val > max_freq || val < min_freq)
+ return -EINVAL;
+ ret = smu_set_soft_freq_range(&adev->smu, SMU_SCLK, (uint32_t)val, (uint32_t)val, true);
+- } else {
+- return 0;
+ }
+
+ pm_runtime_mark_last_busy(adev->ddev->dev);
+--
+2.25.1
+
--- /dev/null
+From 3ac7d447ef1a85e4a78afc11a262efb46328f8e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 16:33:47 -0400
+Subject: drm/amdgpu/display bail early in dm_pp_get_static_clocks
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 376814f5fcf1aadda501d1413d56e8af85d19a97 ]
+
+If there are no supported callbacks. We'll fall back to the
+nominal clocks.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1170
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+index a2e1a73f66b81..7cee8070cb113 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+@@ -530,6 +530,8 @@ bool dm_pp_get_static_clocks(
+ &pp_clk_info);
+ else if (adev->smu.ppt_funcs)
+ ret = smu_get_current_clocks(&adev->smu, &pp_clk_info);
++ else
++ return false;
+ if (ret)
+ return false;
+
+--
+2.25.1
+
--- /dev/null
+From a85fce69092137d2b2a1ad0cf1588ef0b57b9bfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 16:36:05 -0400
+Subject: drm/amdgpu/display: properly guard the calls to swSMU functions
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 4072327a2622af8688b88f5cd0a472136d3bf33d ]
+
+It's only applicable on newer asics. We could end up here when
+using DC on older asics like SI or KV.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1170
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+index 7cee8070cb113..5c6a6ae48d396 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+@@ -106,7 +106,7 @@ bool dm_pp_apply_display_requirements(
+ adev->powerplay.pp_funcs->display_configuration_change(
+ adev->powerplay.pp_handle,
+ &adev->pm.pm_display_cfg);
+- else
++ else if (adev->smu.ppt_funcs)
+ smu_display_configuration_change(smu,
+ &adev->pm.pm_display_cfg);
+
+@@ -592,7 +592,7 @@ void pp_rv_set_wm_ranges(struct pp_smu *pp,
+ if (pp_funcs && pp_funcs->set_watermarks_for_clocks_ranges)
+ pp_funcs->set_watermarks_for_clocks_ranges(pp_handle,
+ &wm_with_clock_ranges);
+- else
++ else if (adev->smu.ppt_funcs)
+ smu_set_watermarks_for_clock_ranges(&adev->smu,
+ &wm_with_clock_ranges);
+ }
+--
+2.25.1
+
--- /dev/null
+From fd3cb58ad6ef64e8cc72d436b56be7756ccfc04d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 15:54:18 +0100
+Subject: drm/amdgpu: ensure 0 is returned for success in
+ jpeg_v2_5_wait_for_idle
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 57f01856645afe4c3d0f9915ee2bb043e8dd7982 ]
+
+In the cases where adev->jpeg.num_jpeg_inst is zero or the condition
+adev->jpeg.harvest_config & (1 << i) is always non-zero the variable
+ret is never set to an error condition and the function returns
+an uninitialized value in ret. Since the only exit condition at
+the end if the function is a success then explicitly return
+0 rather than a potentially uninitialized value in ret.
+
+Addresses-Coverity: ("Uninitialized scalar variable")
+Fixes: 14f43e8f88c5 ("drm/amdgpu: move JPEG2.5 out from VCN2.5")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
+index 713c325604453..25ebf8f19b85a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
+@@ -462,7 +462,7 @@ static int jpeg_v2_5_wait_for_idle(void *handle)
+ return ret;
+ }
+
+- return ret;
++ return 0;
+ }
+
+ static int jpeg_v2_5_set_clockgating_state(void *handle,
+--
+2.25.1
+
--- /dev/null
+From ca49ff2d1550e65073791d983edfd3701a2e4a48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 May 2020 10:50:47 +0100
+Subject: drm/amdgpu: use the unlocked drm_gem_object_put
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Emil Velikov <emil.velikov@collabora.com>
+
+[ Upstream commit 1a87f67a66de4ad0c0d79fd86b6c5273143387c3 ]
+
+The driver does not hold struct_mutex, thus using the locked version of
+the helper is incorrect.
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: amd-gfx@lists.freedesktop.org
+Fixes: a39414716ca0 ("drm/amdgpu: add independent DMA-buf import v9")
+Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-8-emil.l.velikov@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+index 43d8ed7dbd001..652c57a3b8478 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+@@ -587,7 +587,7 @@ struct drm_gem_object *amdgpu_gem_prime_import(struct drm_device *dev,
+ attach = dma_buf_dynamic_attach(dma_buf, dev->dev,
+ &amdgpu_dma_buf_attach_ops, obj);
+ if (IS_ERR(attach)) {
+- drm_gem_object_put(obj);
++ drm_gem_object_put_unlocked(obj);
+ return ERR_CAST(attach);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From c016724e594f33d6bc8395f346fb53e31c809c93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 11:04:00 +0100
+Subject: drm/arm: fix unintentional integer overflow on left shift
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5f368ddea6fec519bdb93b5368f6a844b6ea27a6 ]
+
+Shifting the integer value 1 is evaluated using 32-bit arithmetic
+and then used in an expression that expects a long value leads to
+a potential integer overflow. Fix this by using the BIT macro to
+perform the shift to avoid the overflow.
+
+Addresses-Coverity: ("Unintentional integer overflow")
+Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Liviu Dudau <Liviu.Dudau@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200618100400.11464-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/arm/malidp_planes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
+index 37715cc6064e6..ab45ac445045a 100644
+--- a/drivers/gpu/drm/arm/malidp_planes.c
++++ b/drivers/gpu/drm/arm/malidp_planes.c
+@@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)
+ const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
+ struct malidp_plane *plane = NULL;
+ enum drm_plane_type plane_type;
+- unsigned long crtcs = 1 << drm->mode_config.num_crtc;
++ unsigned long crtcs = BIT(drm->mode_config.num_crtc);
+ unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
+ DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
+ unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
+--
+2.25.1
+
--- /dev/null
+From 4d59a8f0c74aee6bc12f9b849a87dbaa34fcea56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jul 2020 08:24:53 -0700
+Subject: drm/bridge: sil_sii8620: initialize return of sii8620_readb
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 02cd2d3144653e6e2a0c7ccaa73311e48e2dc686 ]
+
+clang static analysis flags this error
+
+sil-sii8620.c:184:2: warning: Undefined or garbage value
+ returned to caller [core.uninitialized.UndefReturn]
+ return ret;
+ ^~~~~~~~~~
+
+sii8620_readb calls sii8620_read_buf.
+sii8620_read_buf can return without setting its output
+pararmeter 'ret'.
+
+So initialize ret.
+
+Fixes: ce6e153f414a ("drm/bridge: add Silicon Image SiI8620 driver")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200712152453.27510-1-trix@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index 92acd336aa894..ca98133411aab 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -178,7 +178,7 @@ static void sii8620_read_buf(struct sii8620 *ctx, u16 addr, u8 *buf, int len)
+
+ static u8 sii8620_readb(struct sii8620 *ctx, u16 addr)
+ {
+- u8 ret;
++ u8 ret = 0;
+
+ sii8620_read_buf(ctx, addr, &ret, 1);
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From 68a6200f11e62b720bd9969587863ba07549f74b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 May 2020 16:33:29 -0700
+Subject: drm/bridge: ti-sn65dsi86: Clear old error bits before AUX transfers
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit baef4d56195b6d6e0f681f6eac03d8c6db011d34 ]
+
+The AUX channel transfer error bits in the status register are latched
+and need to be cleared. Clear them before doing our transfer so we
+don't see old bits and get confused.
+
+Without this patch having a single failure would mean that all future
+transfers would look like they failed.
+
+Fixes: b814ec6d4535 ("drm/bridge: ti-sn65dsi86: Implement AUX channel")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200508163314.1.Idfa69d5d3fc9623083c0ff78572fea87dccb199c@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index 6ad688b320aee..d865cc2565bc0 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -827,6 +827,12 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux,
+ buf[i]);
+ }
+
++ /* Clear old status bits before start so we don't get confused */
++ regmap_write(pdata->regmap, SN_AUX_CMD_STATUS_REG,
++ AUX_IRQ_STATUS_NAT_I2C_FAIL |
++ AUX_IRQ_STATUS_AUX_RPLY_TOUT |
++ AUX_IRQ_STATUS_AUX_SHORT);
++
+ regmap_write(pdata->regmap, SN_AUX_CMD_REG, request_val | AUX_CMD_SEND);
+
+ ret = regmap_read_poll_timeout(pdata->regmap, SN_AUX_CMD_REG, val,
+--
+2.25.1
+
--- /dev/null
+From 85b92c7529039bb5471f6750733e769280f6c162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2020 21:32:29 -0700
+Subject: drm/bridge: ti-sn65dsi86: Fix off-by-one error in clock choice
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit fe3d7a35497c807d0dad0642afd87d6ba5b6fc86 ]
+
+If the rate in our table is _equal_ to the rate we want then it's OK
+to pick it. It doesn't need to be greater than the one we want.
+
+Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200504213225.1.I21646c7c37ff63f52ae6cdccc9bc829fbc3d9424@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index d865cc2565bc0..8a0e34f2160af 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -475,7 +475,7 @@ static int ti_sn_bridge_calc_min_dp_rate_idx(struct ti_sn_bridge *pdata)
+ 1000 * pdata->dp_lanes * DP_CLK_FUDGE_DEN);
+
+ for (i = 1; i < ARRAY_SIZE(ti_sn_bridge_dp_rate_lut) - 1; i++)
+- if (ti_sn_bridge_dp_rate_lut[i] > dp_rate_mhz)
++ if (ti_sn_bridge_dp_rate_lut[i] >= dp_rate_mhz)
+ break;
+
+ return i;
+--
+2.25.1
+
--- /dev/null
+From eca66f347e98354a5dda3696d55682f61f2cb488 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2017 12:43:07 +0200
+Subject: drm/debugfs: fix plain echo to connector "force" attribute
+
+From: Michael Tretter <m.tretter@pengutronix.de>
+
+[ Upstream commit c704b17071c4dc571dca3af4e4151dac51de081a ]
+
+Using plain echo to set the "force" connector attribute fails with
+-EINVAL, because echo appends a newline to the output.
+
+Replace strcmp with sysfs_streq to also accept strings that end with a
+newline.
+
+v2: use sysfs_streq instead of stripping trailing whitespace
+
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20170817104307.17124-1-m.tretter@pengutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_debugfs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
+index 2bea221307037..bfe4602f206b4 100644
+--- a/drivers/gpu/drm/drm_debugfs.c
++++ b/drivers/gpu/drm/drm_debugfs.c
+@@ -311,13 +311,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf,
+
+ buf[len] = '\0';
+
+- if (!strcmp(buf, "on"))
++ if (sysfs_streq(buf, "on"))
+ connector->force = DRM_FORCE_ON;
+- else if (!strcmp(buf, "digital"))
++ else if (sysfs_streq(buf, "digital"))
+ connector->force = DRM_FORCE_ON_DIGITAL;
+- else if (!strcmp(buf, "off"))
++ else if (sysfs_streq(buf, "off"))
+ connector->force = DRM_FORCE_OFF;
+- else if (!strcmp(buf, "unspecified"))
++ else if (sysfs_streq(buf, "unspecified"))
+ connector->force = DRM_FORCE_UNSPECIFIED;
+ else
+ return -EINVAL;
+--
+2.25.1
+
--- /dev/null
+From e19c15951c2ce024a137a3e7d864fa35df3eb5d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 23:21:24 +0200
+Subject: drm/etnaviv: Fix error path on failure to enable bus clk
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit f8794feaf65cdc97767604cf864775d20b97f397 ]
+
+Since commit 65f037e8e908 ("drm/etnaviv: add support for slave interface
+clock") the reg clock is enabled before the bus clock and we need to undo
+its enablement on error.
+
+Fixes: 65f037e8e908 ("drm/etnaviv: add support for slave interface clock")
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index 7c9f3f9ba1235..4a512b062df8f 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -1502,7 +1502,7 @@ static int etnaviv_gpu_clk_enable(struct etnaviv_gpu *gpu)
+ if (gpu->clk_bus) {
+ ret = clk_prepare_enable(gpu->clk_bus);
+ if (ret)
+- return ret;
++ goto disable_clk_reg;
+ }
+
+ if (gpu->clk_core) {
+@@ -1525,6 +1525,9 @@ static int etnaviv_gpu_clk_enable(struct etnaviv_gpu *gpu)
+ disable_clk_bus:
+ if (gpu->clk_bus)
+ clk_disable_unprepare(gpu->clk_bus);
++disable_clk_reg:
++ if (gpu->clk_reg)
++ clk_disable_unprepare(gpu->clk_reg);
+
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 628193cadaa6ec69ba55cd3232b5af020ea02869 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 01:12:20 -0500
+Subject: drm/etnaviv: fix ref count leak via pm_runtime_get_sync
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit c5d5a32ead1e3a61a07a1e59eb52a53e4a6b2a7f ]
+
+in etnaviv_gpu_submit, etnaviv_gpu_recover_hang, etnaviv_gpu_debugfs,
+and etnaviv_gpu_init the call to pm_runtime_get_sync increments the
+counter even in case of failure, leading to incorrect ref count.
+In case of failure, decrement the ref count before returning.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index a31eeff2b297a..7c9f3f9ba1235 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -722,7 +722,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+ ret = pm_runtime_get_sync(gpu->dev);
+ if (ret < 0) {
+ dev_err(gpu->dev, "Failed to enable GPU power domain\n");
+- return ret;
++ goto pm_put;
+ }
+
+ etnaviv_hw_identify(gpu);
+@@ -819,6 +819,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+
+ fail:
+ pm_runtime_mark_last_busy(gpu->dev);
++pm_put:
+ pm_runtime_put_autosuspend(gpu->dev);
+
+ return ret;
+@@ -859,7 +860,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m)
+
+ ret = pm_runtime_get_sync(gpu->dev);
+ if (ret < 0)
+- return ret;
++ goto pm_put;
+
+ dma_lo = gpu_read(gpu, VIVS_FE_DMA_LOW);
+ dma_hi = gpu_read(gpu, VIVS_FE_DMA_HIGH);
+@@ -1003,6 +1004,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m)
+ ret = 0;
+
+ pm_runtime_mark_last_busy(gpu->dev);
++pm_put:
+ pm_runtime_put_autosuspend(gpu->dev);
+
+ return ret;
+@@ -1016,7 +1018,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu)
+ dev_err(gpu->dev, "recover hung GPU!\n");
+
+ if (pm_runtime_get_sync(gpu->dev) < 0)
+- return;
++ goto pm_put;
+
+ mutex_lock(&gpu->lock);
+
+@@ -1035,6 +1037,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu)
+
+ mutex_unlock(&gpu->lock);
+ pm_runtime_mark_last_busy(gpu->dev);
++pm_put:
+ pm_runtime_put_autosuspend(gpu->dev);
+ }
+
+@@ -1308,8 +1311,10 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
+
+ if (!submit->runtime_resumed) {
+ ret = pm_runtime_get_sync(gpu->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(gpu->dev);
+ return NULL;
++ }
+ submit->runtime_resumed = true;
+ }
+
+@@ -1326,6 +1331,7 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
+ ret = event_alloc(gpu, nr_events, event);
+ if (ret) {
+ DRM_ERROR("no free events\n");
++ pm_runtime_put_noidle(gpu->dev);
+ return NULL;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 35af39d3ea9ec8951673b3aa54eca0179dd398f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Mar 2020 16:23:34 +0300
+Subject: drm/gem: Fix a leak in drm_gem_objects_lookup()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ec0bb482de0ad5e4aba2a4537ea53eaeb77d11a6 ]
+
+If the "handles" allocation or the copy_from_user() fails then we leak
+"objs". It's supposed to be freed in panfrost_job_cleanup().
+
+Fixes: c117aa4d8701 ("drm: Add a drm_gem_objects_lookup helper")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200320132334.GC95012@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_gem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index ee2058ad482c4..d22480ebb29ec 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -709,6 +709,8 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
+ if (!objs)
+ return -ENOMEM;
+
++ *objs_out = objs;
++
+ handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL);
+ if (!handles) {
+ ret = -ENOMEM;
+@@ -722,8 +724,6 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
+ }
+
+ ret = objects_lookup(filp, handles, count, objs);
+- *objs_out = objs;
+-
+ out:
+ kvfree(handles);
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From 77255ea1ea02add4840eb714e080d88afea7f1df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jun 2020 14:43:31 +0200
+Subject: drm/imx: fix use after free
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit ba807c94f67fd64b3051199810d9e4dd209fdc00 ]
+
+Component driver structures allocated with devm_kmalloc() in bind() are
+freed automatically after unbind(). Since the contained drm structures
+are accessed afterwards in drm_mode_config_cleanup(), move the
+allocation into probe() to extend the driver structure's lifetime to the
+lifetime of the device. This should eventually be changed to use drm
+resource managed allocations with lifetime of the drm device.
+
+We also need to ensure that all componets are available during the
+unbind() so we need to call component_unbind_all() before we free
+non-devres resources like planes.
+
+Note this patch fixes the the use after free bug but introduces a
+possible boot loop issue. The issue is triggered if the HDMI support is
+enabled and a component driver always return -EPROBE_DEFER, see
+discussion [1] for more details.
+
+[1] https://lkml.org/lkml/2020/3/24/1467
+
+Fixes: 17b5001b5143 ("imx-drm: convert to componentised device support")
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+[m.felsch@pengutronix: fix imx_tve_probe()]
+[m.felsch@pengutronix: resort component_unbind_all())
+[m.felsch@pengutronix: adapt commit message]
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imx/dw_hdmi-imx.c | 15 ++++++++++-----
+ drivers/gpu/drm/imx/imx-drm-core.c | 3 ++-
+ drivers/gpu/drm/imx/imx-ldb.c | 15 ++++++++++-----
+ drivers/gpu/drm/imx/imx-tve.c | 15 ++++++++++-----
+ drivers/gpu/drm/imx/ipuv3-crtc.c | 21 ++++++++++-----------
+ drivers/gpu/drm/imx/parallel-display.c | 15 ++++++++++-----
+ 6 files changed, 52 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/dw_hdmi-imx.c b/drivers/gpu/drm/imx/dw_hdmi-imx.c
+index ba4ca17fd4d85..87869b9997a6e 100644
+--- a/drivers/gpu/drm/imx/dw_hdmi-imx.c
++++ b/drivers/gpu/drm/imx/dw_hdmi-imx.c
+@@ -209,9 +209,8 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master,
+ if (!pdev->dev.of_node)
+ return -ENODEV;
+
+- hdmi = devm_kzalloc(&pdev->dev, sizeof(*hdmi), GFP_KERNEL);
+- if (!hdmi)
+- return -ENOMEM;
++ hdmi = dev_get_drvdata(dev);
++ memset(hdmi, 0, sizeof(*hdmi));
+
+ match = of_match_node(dw_hdmi_imx_dt_ids, pdev->dev.of_node);
+ plat_data = match->data;
+@@ -235,8 +234,6 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master,
+ drm_encoder_helper_add(encoder, &dw_hdmi_imx_encoder_helper_funcs);
+ drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS);
+
+- platform_set_drvdata(pdev, hdmi);
+-
+ hdmi->hdmi = dw_hdmi_bind(pdev, encoder, plat_data);
+
+ /*
+@@ -266,6 +263,14 @@ static const struct component_ops dw_hdmi_imx_ops = {
+
+ static int dw_hdmi_imx_probe(struct platform_device *pdev)
+ {
++ struct imx_hdmi *hdmi;
++
++ hdmi = devm_kzalloc(&pdev->dev, sizeof(*hdmi), GFP_KERNEL);
++ if (!hdmi)
++ return -ENOMEM;
++
++ platform_set_drvdata(pdev, hdmi);
++
+ return component_add(&pdev->dev, &dw_hdmi_imx_ops);
+ }
+
+diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
+index 2e38f1a5cf8da..3421043a558d5 100644
+--- a/drivers/gpu/drm/imx/imx-drm-core.c
++++ b/drivers/gpu/drm/imx/imx-drm-core.c
+@@ -275,9 +275,10 @@ static void imx_drm_unbind(struct device *dev)
+
+ drm_kms_helper_poll_fini(drm);
+
++ component_unbind_all(drm->dev, drm);
++
+ drm_mode_config_cleanup(drm);
+
+- component_unbind_all(drm->dev, drm);
+ dev_set_drvdata(dev, NULL);
+
+ drm_dev_put(drm);
+diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
+index 66ea68e8da875..1823af9936c98 100644
+--- a/drivers/gpu/drm/imx/imx-ldb.c
++++ b/drivers/gpu/drm/imx/imx-ldb.c
+@@ -590,9 +590,8 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ int ret;
+ int i;
+
+- imx_ldb = devm_kzalloc(dev, sizeof(*imx_ldb), GFP_KERNEL);
+- if (!imx_ldb)
+- return -ENOMEM;
++ imx_ldb = dev_get_drvdata(dev);
++ memset(imx_ldb, 0, sizeof(*imx_ldb));
+
+ imx_ldb->regmap = syscon_regmap_lookup_by_phandle(np, "gpr");
+ if (IS_ERR(imx_ldb->regmap)) {
+@@ -700,8 +699,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ }
+ }
+
+- dev_set_drvdata(dev, imx_ldb);
+-
+ return 0;
+
+ free_child:
+@@ -733,6 +730,14 @@ static const struct component_ops imx_ldb_ops = {
+
+ static int imx_ldb_probe(struct platform_device *pdev)
+ {
++ struct imx_ldb *imx_ldb;
++
++ imx_ldb = devm_kzalloc(&pdev->dev, sizeof(*imx_ldb), GFP_KERNEL);
++ if (!imx_ldb)
++ return -ENOMEM;
++
++ platform_set_drvdata(pdev, imx_ldb);
++
+ return component_add(&pdev->dev, &imx_ldb_ops);
+ }
+
+diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
+index ee63782c77e9c..82d1ee1fb0c84 100644
+--- a/drivers/gpu/drm/imx/imx-tve.c
++++ b/drivers/gpu/drm/imx/imx-tve.c
+@@ -542,9 +542,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
+ int irq;
+ int ret;
+
+- tve = devm_kzalloc(dev, sizeof(*tve), GFP_KERNEL);
+- if (!tve)
+- return -ENOMEM;
++ tve = dev_get_drvdata(dev);
++ memset(tve, 0, sizeof(*tve));
+
+ tve->dev = dev;
+ spin_lock_init(&tve->lock);
+@@ -655,8 +654,6 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
+ if (ret)
+ return ret;
+
+- dev_set_drvdata(dev, tve);
+-
+ return 0;
+ }
+
+@@ -676,6 +673,14 @@ static const struct component_ops imx_tve_ops = {
+
+ static int imx_tve_probe(struct platform_device *pdev)
+ {
++ struct imx_tve *tve;
++
++ tve = devm_kzalloc(&pdev->dev, sizeof(*tve), GFP_KERNEL);
++ if (!tve)
++ return -ENOMEM;
++
++ platform_set_drvdata(pdev, tve);
++
+ return component_add(&pdev->dev, &imx_tve_ops);
+ }
+
+diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
+index 63c0284f8b3c0..2256c9789fc2c 100644
+--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
+@@ -438,21 +438,13 @@ static int ipu_drm_bind(struct device *dev, struct device *master, void *data)
+ struct ipu_client_platformdata *pdata = dev->platform_data;
+ struct drm_device *drm = data;
+ struct ipu_crtc *ipu_crtc;
+- int ret;
+
+- ipu_crtc = devm_kzalloc(dev, sizeof(*ipu_crtc), GFP_KERNEL);
+- if (!ipu_crtc)
+- return -ENOMEM;
++ ipu_crtc = dev_get_drvdata(dev);
++ memset(ipu_crtc, 0, sizeof(*ipu_crtc));
+
+ ipu_crtc->dev = dev;
+
+- ret = ipu_crtc_init(ipu_crtc, pdata, drm);
+- if (ret)
+- return ret;
+-
+- dev_set_drvdata(dev, ipu_crtc);
+-
+- return 0;
++ return ipu_crtc_init(ipu_crtc, pdata, drm);
+ }
+
+ static void ipu_drm_unbind(struct device *dev, struct device *master,
+@@ -474,6 +466,7 @@ static const struct component_ops ipu_crtc_ops = {
+ static int ipu_drm_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
++ struct ipu_crtc *ipu_crtc;
+ int ret;
+
+ if (!dev->platform_data)
+@@ -483,6 +476,12 @@ static int ipu_drm_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
++ ipu_crtc = devm_kzalloc(dev, sizeof(*ipu_crtc), GFP_KERNEL);
++ if (!ipu_crtc)
++ return -ENOMEM;
++
++ dev_set_drvdata(dev, ipu_crtc);
++
+ return component_add(dev, &ipu_crtc_ops);
+ }
+
+diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
+index ac916c84a6318..622eabe9efb31 100644
+--- a/drivers/gpu/drm/imx/parallel-display.c
++++ b/drivers/gpu/drm/imx/parallel-display.c
+@@ -326,9 +326,8 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
+ u32 bus_format = 0;
+ const char *fmt;
+
+- imxpd = devm_kzalloc(dev, sizeof(*imxpd), GFP_KERNEL);
+- if (!imxpd)
+- return -ENOMEM;
++ imxpd = dev_get_drvdata(dev);
++ memset(imxpd, 0, sizeof(*imxpd));
+
+ edidp = of_get_property(np, "edid", &imxpd->edid_len);
+ if (edidp)
+@@ -359,8 +358,6 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
+ if (ret)
+ return ret;
+
+- dev_set_drvdata(dev, imxpd);
+-
+ return 0;
+ }
+
+@@ -382,6 +379,14 @@ static const struct component_ops imx_pd_ops = {
+
+ static int imx_pd_probe(struct platform_device *pdev)
+ {
++ struct imx_parallel_display *imxpd;
++
++ imxpd = devm_kzalloc(&pdev->dev, sizeof(*imxpd), GFP_KERNEL);
++ if (!imxpd)
++ return -ENOMEM;
++
++ platform_set_drvdata(pdev, imxpd);
++
+ return component_add(&pdev->dev, &imx_pd_ops);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From bfd7edea2e0b84797f6165896f376c72ceca9c50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jun 2020 14:43:32 +0200
+Subject: drm/imx: tve: fix regulator_disable error path
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 7bb58b987fee26da2a1665c01033022624986b7c ]
+
+Add missing regulator_disable() as devm_action to avoid dedicated
+unbind() callback and fix the missing error handling.
+
+Fixes: fcbc51e54d2a ("staging: drm/imx: Add support for Television Encoder (TVEv2)")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imx/imx-tve.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
+index 82d1ee1fb0c84..3758de3e09bdf 100644
+--- a/drivers/gpu/drm/imx/imx-tve.c
++++ b/drivers/gpu/drm/imx/imx-tve.c
+@@ -490,6 +490,13 @@ static int imx_tve_register(struct drm_device *drm, struct imx_tve *tve)
+ return 0;
+ }
+
++static void imx_tve_disable_regulator(void *data)
++{
++ struct imx_tve *tve = data;
++
++ regulator_disable(tve->dac_reg);
++}
++
+ static bool imx_tve_readable_reg(struct device *dev, unsigned int reg)
+ {
+ return (reg % 4 == 0) && (reg <= 0xdc);
+@@ -613,6 +620,9 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
+ ret = regulator_enable(tve->dac_reg);
+ if (ret)
+ return ret;
++ ret = devm_add_action_or_reset(dev, imx_tve_disable_regulator, tve);
++ if (ret)
++ return ret;
+ }
+
+ tve->clk = devm_clk_get(dev, "tve");
+@@ -657,18 +667,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+ }
+
+-static void imx_tve_unbind(struct device *dev, struct device *master,
+- void *data)
+-{
+- struct imx_tve *tve = dev_get_drvdata(dev);
+-
+- if (!IS_ERR(tve->dac_reg))
+- regulator_disable(tve->dac_reg);
+-}
+-
+ static const struct component_ops imx_tve_ops = {
+ .bind = imx_tve_bind,
+- .unbind = imx_tve_unbind,
+ };
+
+ static int imx_tve_probe(struct platform_device *pdev)
+--
+2.25.1
+
--- /dev/null
+From 769a45689e553d1b980c0b4c2a3cf670e892937a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 May 2020 17:03:29 +0100
+Subject: drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
+
+From: Emil Velikov <emil.velikov@collabora.com>
+
+[ Upstream commit 7a05c3b6d24b8460b3cec436cf1d33fac43c8450 ]
+
+The helper uses the MIPI_DCS_SET_TEAR_SCANLINE, although it's currently
+using the generic write. This does not look right.
+
+Perhaps some platforms don't distinguish between the two writers?
+
+Cc: Robert Chiras <robert.chiras@nxp.com>
+Cc: Vinay Simha BN <simhavcs@gmail.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Thierry Reding <treding@nvidia.com>
+Fixes: e83950816367 ("drm/dsi: Implement set tear scanline")
+Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200505160329.2976059-3-emil.l.velikov@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dsi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index 55531895dde6d..37b03fefbdf6f 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -1082,11 +1082,11 @@ EXPORT_SYMBOL(mipi_dsi_dcs_set_pixel_format);
+ */
+ int mipi_dsi_dcs_set_tear_scanline(struct mipi_dsi_device *dsi, u16 scanline)
+ {
+- u8 payload[3] = { MIPI_DCS_SET_TEAR_SCANLINE, scanline >> 8,
+- scanline & 0xff };
++ u8 payload[2] = { scanline >> 8, scanline & 0xff };
+ ssize_t err;
+
+- err = mipi_dsi_generic_write(dsi, payload, sizeof(payload));
++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_TEAR_SCANLINE, payload,
++ sizeof(payload));
+ if (err < 0)
+ return err;
+
+--
+2.25.1
+
--- /dev/null
+From ae6b654ecc0db07535df6b8f99eb14b9a2b2836b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 May 2020 16:04:01 +0200
+Subject: drm/mm: fix hole size comparison
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nirmoy Das <nirmoy.aiemd@gmail.com>
+
+[ Upstream commit 18ece75d7d74eb108f6a7325cf247077a666cba8 ]
+
+Fixes: 0cdea4455acd350a ("drm/mm: optimize rb_hole_addr rbtree search")
+
+Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
+Reported-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/367726/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
+index f4ca1ff80af9f..60e9a9c91e9d9 100644
+--- a/drivers/gpu/drm/drm_mm.c
++++ b/drivers/gpu/drm/drm_mm.c
+@@ -407,7 +407,7 @@ next_hole_high_addr(struct drm_mm_node *entry, u64 size)
+ left_node = rb_entry(left_rb_node,
+ struct drm_mm_node, rb_hole_addr);
+ if ((left_node->subtree_max_hole < size ||
+- entry->size == entry->subtree_max_hole) &&
++ HOLE_SIZE(entry) == entry->subtree_max_hole) &&
+ parent_rb_node && parent_rb_node->rb_left != rb_node)
+ return rb_hole_addr_to_node(parent_rb_node);
+ }
+@@ -447,7 +447,7 @@ next_hole_low_addr(struct drm_mm_node *entry, u64 size)
+ right_node = rb_entry(right_rb_node,
+ struct drm_mm_node, rb_hole_addr);
+ if ((right_node->subtree_max_hole < size ||
+- entry->size == entry->subtree_max_hole) &&
++ HOLE_SIZE(entry) == entry->subtree_max_hole) &&
+ parent_rb_node && parent_rb_node->rb_right != rb_node)
+ return rb_hole_addr_to_node(parent_rb_node);
+ }
+--
+2.25.1
+
--- /dev/null
+From 2804b381713045ac56c29e54aa737ef15da4f34a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 20:04:18 +0530
+Subject: drm: msm: a6xx: fix gpu failure after system resume
+
+From: Akhil P Oommen <akhilpo@codeaurora.org>
+
+[ Upstream commit 57c0bd517c06b088106b0236ed604056c8e06da5 ]
+
+On targets where GMU is available, GMU takes over the ownership of GX GDSC
+during its initialization. So, move the refcount-get on GX PD before we
+initialize the GMU. This ensures that nobody can collapse the GX GDSC
+once GMU owns the GX GDSC. This patch fixes some GMU OOB errors seen
+during GPU wake up during a system resume.
+
+Reported-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org>
+Tested-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index 21e77d67151f5..1d330204c465c 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -854,10 +854,19 @@ int a6xx_gmu_resume(struct a6xx_gpu *a6xx_gpu)
+ /* Turn on the resources */
+ pm_runtime_get_sync(gmu->dev);
+
++ /*
++ * "enable" the GX power domain which won't actually do anything but it
++ * will make sure that the refcounting is correct in case we need to
++ * bring down the GX after a GMU failure
++ */
++ if (!IS_ERR_OR_NULL(gmu->gxpd))
++ pm_runtime_get_sync(gmu->gxpd);
++
+ /* Use a known rate to bring up the GMU */
+ clk_set_rate(gmu->core_clk, 200000000);
+ ret = clk_bulk_prepare_enable(gmu->nr_clocks, gmu->clocks);
+ if (ret) {
++ pm_runtime_put(gmu->gxpd);
+ pm_runtime_put(gmu->dev);
+ return ret;
+ }
+@@ -903,19 +912,12 @@ int a6xx_gmu_resume(struct a6xx_gpu *a6xx_gpu)
+ else
+ a6xx_hfi_set_freq(gmu, gmu->current_perf_index);
+
+- /*
+- * "enable" the GX power domain which won't actually do anything but it
+- * will make sure that the refcounting is correct in case we need to
+- * bring down the GX after a GMU failure
+- */
+- if (!IS_ERR_OR_NULL(gmu->gxpd))
+- pm_runtime_get(gmu->gxpd);
+-
+ out:
+ /* On failure, shut down the GMU to leave it in a good state */
+ if (ret) {
+ disable_irq(gmu->gmu_irq);
+ a6xx_rpmh_stop(gmu);
++ pm_runtime_put(gmu->gxpd);
+ pm_runtime_put(gmu->dev);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 50cfd41ce4a657bde69cc546192c650df2285c83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 20:47:27 -0400
+Subject: drm/msm/dpu: don't use INTF_INPUT_CTRL feature on sdm845
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit cace3ac4bc08c5261aa4360a7d7aacc45a362fc2 ]
+
+The INTF_INPUT_CTRL feature is not available on sdm845, so don't set it.
+
+This also adds separate feature bits for INTF (based on downstream) instead
+of using CTL feature bit for it, and removes the unnecessary NULL check in
+the added bind_pingpong_blk function.
+
+Fixes: 73bfb790ac786ca55fa2786a06f59 ("msm:disp:dpu1: setup display datapath for SC7180 target")
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 20 +++++++++++--------
+ .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 13 ++++++++++++
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 9 ++-------
+ 3 files changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index 29d4fde3172b4..8ef2f62e4111c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -43,6 +43,10 @@
+
+ #define DSPP_SC7180_MASK BIT(DPU_DSPP_PCC)
+
++#define INTF_SDM845_MASK (0)
++
++#define INTF_SC7180_MASK BIT(DPU_INTF_INPUT_CTRL) | BIT(DPU_INTF_TE)
++
+ #define DEFAULT_PIXEL_RAM_SIZE (50 * 1024)
+ #define DEFAULT_DPU_LINE_WIDTH 2048
+ #define DEFAULT_DPU_OUTPUT_LINE_WIDTH 2560
+@@ -400,26 +404,26 @@ static struct dpu_pingpong_cfg sc7180_pp[] = {
+ /*************************************************************
+ * INTF sub blocks config
+ *************************************************************/
+-#define INTF_BLK(_name, _id, _base, _type, _ctrl_id) \
++#define INTF_BLK(_name, _id, _base, _type, _ctrl_id, _features) \
+ {\
+ .name = _name, .id = _id, \
+ .base = _base, .len = 0x280, \
+- .features = BIT(DPU_CTL_ACTIVE_CFG), \
++ .features = _features, \
+ .type = _type, \
+ .controller_id = _ctrl_id, \
+ .prog_fetch_lines_worst_case = 24 \
+ }
+
+ static const struct dpu_intf_cfg sdm845_intf[] = {
+- INTF_BLK("intf_0", INTF_0, 0x6A000, INTF_DP, 0),
+- INTF_BLK("intf_1", INTF_1, 0x6A800, INTF_DSI, 0),
+- INTF_BLK("intf_2", INTF_2, 0x6B000, INTF_DSI, 1),
+- INTF_BLK("intf_3", INTF_3, 0x6B800, INTF_DP, 1),
++ INTF_BLK("intf_0", INTF_0, 0x6A000, INTF_DP, 0, INTF_SDM845_MASK),
++ INTF_BLK("intf_1", INTF_1, 0x6A800, INTF_DSI, 0, INTF_SDM845_MASK),
++ INTF_BLK("intf_2", INTF_2, 0x6B000, INTF_DSI, 1, INTF_SDM845_MASK),
++ INTF_BLK("intf_3", INTF_3, 0x6B800, INTF_DP, 1, INTF_SDM845_MASK),
+ };
+
+ static const struct dpu_intf_cfg sc7180_intf[] = {
+- INTF_BLK("intf_0", INTF_0, 0x6A000, INTF_DP, 0),
+- INTF_BLK("intf_1", INTF_1, 0x6A800, INTF_DSI, 0),
++ INTF_BLK("intf_0", INTF_0, 0x6A000, INTF_DP, 0, INTF_SC7180_MASK),
++ INTF_BLK("intf_1", INTF_1, 0x6A800, INTF_DSI, 0, INTF_SC7180_MASK),
+ };
+
+ /*************************************************************
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+index f7de43838c69c..e4206206a1740 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+@@ -185,6 +185,19 @@ enum {
+ DPU_CTL_MAX
+ };
+
++/**
++ * INTF sub-blocks
++ * @DPU_INTF_INPUT_CTRL Supports the setting of pp block from which
++ * pixel data arrives to this INTF
++ * @DPU_INTF_TE INTF block has TE configuration support
++ * @DPU_INTF_MAX
++ */
++enum {
++ DPU_INTF_INPUT_CTRL = 0x1,
++ DPU_INTF_TE,
++ DPU_INTF_MAX
++};
++
+ /**
+ * VBIF sub-blocks and features
+ * @DPU_VBIF_QOS_OTLIM VBIF supports OT Limit
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+index efe9a5719c6b7..64f556d693dda 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+@@ -225,14 +225,9 @@ static void dpu_hw_intf_bind_pingpong_blk(
+ bool enable,
+ const enum dpu_pingpong pp)
+ {
+- struct dpu_hw_blk_reg_map *c;
++ struct dpu_hw_blk_reg_map *c = &intf->hw;
+ u32 mux_cfg;
+
+- if (!intf)
+- return;
+-
+- c = &intf->hw;
+-
+ mux_cfg = DPU_REG_READ(c, INTF_MUX);
+ mux_cfg &= ~0xf;
+
+@@ -280,7 +275,7 @@ static void _setup_intf_ops(struct dpu_hw_intf_ops *ops,
+ ops->get_status = dpu_hw_intf_get_status;
+ ops->enable_timing = dpu_hw_intf_enable_timing_engine;
+ ops->get_line_count = dpu_hw_intf_get_line_count;
+- if (cap & BIT(DPU_CTL_ACTIVE_CFG))
++ if (cap & BIT(DPU_INTF_INPUT_CTRL))
+ ops->bind_pingpong_blk = dpu_hw_intf_bind_pingpong_blk;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 165e8a6d99eff8325e1365138145f0de7c4f037c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 02:01:55 +0530
+Subject: drm/msm: Fix a null pointer access in msm_gem_shrinker_count()
+
+From: Akhil P Oommen <akhilpo@codeaurora.org>
+
+[ Upstream commit 3cbdc8d8b7f39a7af3ea7b8dfa75caaebfda4e56 ]
+
+Adding an msm_gem_object object to the inactive_list before completing
+its initialization is a bad idea because shrinker may pick it up from the
+inactive_list. Fix this by making sure that the initialization is complete
+before moving the msm_obj object to the inactive list.
+
+This patch fixes the below error:
+[10027.553044] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
+[10027.573305] Mem abort info:
+[10027.590160] ESR = 0x96000006
+[10027.597905] EC = 0x25: DABT (current EL), IL = 32 bits
+[10027.614430] SET = 0, FnV = 0
+[10027.624427] EA = 0, S1PTW = 0
+[10027.632722] Data abort info:
+[10027.638039] ISV = 0, ISS = 0x00000006
+[10027.647459] CM = 0, WnR = 0
+[10027.654345] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001e3a6a000
+[10027.672681] [0000000000000068] pgd=0000000198c31003, pud=0000000198c31003, pmd=0000000000000000
+[10027.693900] Internal error: Oops: 96000006 [#1] PREEMPT SMP
+[10027.738261] CPU: 3 PID: 214 Comm: kswapd0 Tainted: G S 5.4.40 #1
+[10027.745766] Hardware name: Qualcomm Technologies, Inc. SC7180 IDP (DT)
+[10027.752472] pstate: 80c00009 (Nzcv daif +PAN +UAO)
+[10027.757409] pc : mutex_is_locked+0x14/0x2c
+[10027.761626] lr : msm_gem_shrinker_count+0x70/0xec
+[10027.766454] sp : ffffffc011323ad0
+[10027.769867] x29: ffffffc011323ad0 x28: ffffffe677e4b878
+[10027.775324] x27: 0000000000000cc0 x26: 0000000000000000
+[10027.780783] x25: ffffff817114a708 x24: 0000000000000008
+[10027.786242] x23: ffffff8023ab7170 x22: 0000000000000001
+[10027.791701] x21: ffffff817114a080 x20: 0000000000000119
+[10027.797160] x19: 0000000000000068 x18: 00000000000003bc
+[10027.802621] x17: 0000000004a34210 x16: 00000000000000c0
+[10027.808083] x15: 0000000000000000 x14: 0000000000000000
+[10027.813542] x13: ffffffe677e0a3c0 x12: 0000000000000000
+[10027.819000] x11: 0000000000000000 x10: ffffff8174b94340
+[10027.824461] x9 : 0000000000000000 x8 : 0000000000000000
+[10027.829919] x7 : 00000000000001fc x6 : ffffffc011323c88
+[10027.835373] x5 : 0000000000000001 x4 : ffffffc011323d80
+[10027.840832] x3 : ffffffff0477b348 x2 : 0000000000000000
+[10027.846290] x1 : ffffffc011323b68 x0 : 0000000000000068
+[10027.851748] Call trace:
+[10027.854264] mutex_is_locked+0x14/0x2c
+[10027.858121] msm_gem_shrinker_count+0x70/0xec
+[10027.862603] shrink_slab+0xc0/0x4b4
+[10027.866187] shrink_node+0x4a8/0x818
+[10027.869860] kswapd+0x624/0x890
+[10027.873097] kthread+0x11c/0x12c
+[10027.876424] ret_from_fork+0x10/0x18
+[10027.880102] Code: f9000bf3 910003fd aa0003f3 d503201f (f9400268)
+[10027.886362] ---[ end trace df5849a1a3543251 ]---
+[10027.891518] Kernel panic - not syncing: Fatal exception
+
+Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gem.c | 36 ++++++++++++++++++++---------------
+ 1 file changed, 21 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index 6277fde13df91..f63bb7e452d2a 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -994,10 +994,8 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
+
+ static int msm_gem_new_impl(struct drm_device *dev,
+ uint32_t size, uint32_t flags,
+- struct drm_gem_object **obj,
+- bool struct_mutex_locked)
++ struct drm_gem_object **obj)
+ {
+- struct msm_drm_private *priv = dev->dev_private;
+ struct msm_gem_object *msm_obj;
+
+ switch (flags & MSM_BO_CACHE_MASK) {
+@@ -1023,15 +1021,6 @@ static int msm_gem_new_impl(struct drm_device *dev,
+ INIT_LIST_HEAD(&msm_obj->submit_entry);
+ INIT_LIST_HEAD(&msm_obj->vmas);
+
+- if (struct_mutex_locked) {
+- WARN_ON(!mutex_is_locked(&dev->struct_mutex));
+- list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
+- } else {
+- mutex_lock(&dev->struct_mutex);
+- list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
+- mutex_unlock(&dev->struct_mutex);
+- }
+-
+ *obj = &msm_obj->base;
+
+ return 0;
+@@ -1041,6 +1030,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
+ uint32_t size, uint32_t flags, bool struct_mutex_locked)
+ {
+ struct msm_drm_private *priv = dev->dev_private;
++ struct msm_gem_object *msm_obj;
+ struct drm_gem_object *obj = NULL;
+ bool use_vram = false;
+ int ret;
+@@ -1061,14 +1051,15 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
+ if (size == 0)
+ return ERR_PTR(-EINVAL);
+
+- ret = msm_gem_new_impl(dev, size, flags, &obj, struct_mutex_locked);
++ ret = msm_gem_new_impl(dev, size, flags, &obj);
+ if (ret)
+ goto fail;
+
++ msm_obj = to_msm_bo(obj);
++
+ if (use_vram) {
+ struct msm_gem_vma *vma;
+ struct page **pages;
+- struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+ mutex_lock(&msm_obj->lock);
+
+@@ -1103,6 +1094,15 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
+ mapping_set_gfp_mask(obj->filp->f_mapping, GFP_HIGHUSER);
+ }
+
++ if (struct_mutex_locked) {
++ WARN_ON(!mutex_is_locked(&dev->struct_mutex));
++ list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
++ } else {
++ mutex_lock(&dev->struct_mutex);
++ list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
++ mutex_unlock(&dev->struct_mutex);
++ }
++
+ return obj;
+
+ fail:
+@@ -1125,6 +1125,7 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev,
+ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+ struct dma_buf *dmabuf, struct sg_table *sgt)
+ {
++ struct msm_drm_private *priv = dev->dev_private;
+ struct msm_gem_object *msm_obj;
+ struct drm_gem_object *obj;
+ uint32_t size;
+@@ -1138,7 +1139,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+
+ size = PAGE_ALIGN(dmabuf->size);
+
+- ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj, false);
++ ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj);
+ if (ret)
+ goto fail;
+
+@@ -1163,6 +1164,11 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+ }
+
+ mutex_unlock(&msm_obj->lock);
++
++ mutex_lock(&dev->struct_mutex);
++ list_add_tail(&msm_obj->mm_list, &priv->inactive_list);
++ mutex_unlock(&dev->struct_mutex);
++
+ return obj;
+
+ fail:
+--
+2.25.1
+
--- /dev/null
+From c1b1101bd445264120f1119a79481f3f6a996a4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 13:36:00 -0700
+Subject: drm/msm: ratelimit crtc event overflow error
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 5e16372b5940b1fecc3cc887fc02a50ba148d373 ]
+
+This can happen a lot when things go pear shaped. Lets not flood dmesg
+when this happens.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index e15b42a780e04..969d95aa873c4 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -389,7 +389,7 @@ static void dpu_crtc_frame_event_cb(void *data, u32 event)
+ spin_unlock_irqrestore(&dpu_crtc->spin_lock, flags);
+
+ if (!fevent) {
+- DRM_ERROR("crtc%d event %d overflow\n", crtc->base.id, event);
++ DRM_ERROR_RATELIMITED("crtc%d event %d overflow\n", crtc->base.id, event);
+ return;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 8327d51e603419ccf3b236f5496aef6840913cee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:41:56 -0500
+Subject: drm/nouveau: fix multiple instances of reference count leaks
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 659fb5f154c3434c90a34586f3b7aa1c39cf6062 ]
+
+On calling pm_runtime_get_sync() the reference count of the device
+is incremented. In case of failure, decrement the
+ref count before returning the error.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_drm.c | 8 ++++++--
+ drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +++-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index ac93d12201dc0..880d962c1b19a 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -1026,8 +1026,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv)
+
+ /* need to bring up power immediately if opening device */
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ get_task_comm(tmpname, current);
+ snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid));
+@@ -1109,8 +1111,10 @@ nouveau_drm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ long ret;
+
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ switch (_IOC_NR(cmd) - DRM_COMMAND_BASE) {
+ case DRM_NOUVEAU_NVIF:
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 4c3f131ad31da..c5ee5b7364a09 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -45,8 +45,10 @@ nouveau_gem_object_del(struct drm_gem_object *gem)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (WARN_ON(ret < 0 && ret != -EACCES))
++ if (WARN_ON(ret < 0 && ret != -EACCES)) {
++ pm_runtime_put_autosuspend(dev);
+ return;
++ }
+
+ if (gem->import_attach)
+ drm_prime_gem_destroy(gem, nvbo->bo.sg);
+--
+2.25.1
+
--- /dev/null
+From c9669be3c06e5335787fa3fb2c79171a1220373c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:48:37 -0500
+Subject: drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 8f29432417b11039ef960ab18987c7d61b2b5396 ]
+
+nouveau_debugfs_strap_peek() calls pm_runtime_get_sync() that
+increments the reference count. In case of failure, decrement the
+ref count before returning the error.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_debugfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+index 63b5c8cf9ae43..8f63cda3db178 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+@@ -54,8 +54,10 @@ nouveau_debugfs_strap_peek(struct seq_file *m, void *data)
+ int ret;
+
+ ret = pm_runtime_get_sync(drm->dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(drm->dev->dev);
+ return ret;
++ }
+
+ seq_printf(m, "0x%08x\n",
+ nvif_rd32(&drm->client.device.object, 0x101000));
+--
+2.25.1
+
--- /dev/null
+From 718e9832f8463fa8d1ae675443b942c23b58512d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Mar 2020 14:54:06 -0400
+Subject: drm/nouveau/kms/nv50-: Fix disabling dithering
+
+From: Lyude Paul <lyude@redhat.com>
+
+[ Upstream commit fb2420b701edbf96c2b6d557f0139902f455dc2b ]
+
+While we expose the ability to turn off hardware dithering for nouveau,
+we actually make the mistake of turning it on anyway, due to
+dithering_depth containing a non-zero value if our dithering depth isn't
+also set to 6 bpc.
+
+So, fix it by never enabling dithering when it's disabled.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
+Acked-by: Dave Airlie <airlied@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200627194657.156514-6-lyude@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/head.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c
+index 8f6455697ba72..ed6819519f6d8 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/head.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/head.c
+@@ -84,18 +84,20 @@ nv50_head_atomic_check_dither(struct nv50_head_atom *armh,
+ {
+ u32 mode = 0x00;
+
+- if (asyc->dither.mode == DITHERING_MODE_AUTO) {
+- if (asyh->base.depth > asyh->or.bpc * 3)
+- mode = DITHERING_MODE_DYNAMIC2X2;
+- } else {
+- mode = asyc->dither.mode;
+- }
++ if (asyc->dither.mode) {
++ if (asyc->dither.mode == DITHERING_MODE_AUTO) {
++ if (asyh->base.depth > asyh->or.bpc * 3)
++ mode = DITHERING_MODE_DYNAMIC2X2;
++ } else {
++ mode = asyc->dither.mode;
++ }
+
+- if (asyc->dither.depth == DITHERING_DEPTH_AUTO) {
+- if (asyh->or.bpc >= 8)
+- mode |= DITHERING_DEPTH_8BPC;
+- } else {
+- mode |= asyc->dither.depth;
++ if (asyc->dither.depth == DITHERING_DEPTH_AUTO) {
++ if (asyh->or.bpc >= 8)
++ mode |= DITHERING_DEPTH_8BPC;
++ } else {
++ mode |= asyc->dither.depth;
++ }
+ }
+
+ asyh->dither.enable = mode;
+--
+2.25.1
+
--- /dev/null
+From 096a93a0adf2c2b815be3156c9df1135f96e4de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jul 2020 01:53:17 +0300
+Subject: drm: panel: simple: Fix bpc for LG LB070WV8 panel
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit a6ae2fe5c9f9fd355a48fb7d21c863e5b20d6c9c ]
+
+The LG LB070WV8 panel incorrectly reports a 16 bits per component value,
+while the panel uses 8 bits per component. Fix it.
+
+Fixes: dd0150026901 ("drm/panel: simple: Add support for LG LB070WV8 800x480 7" panel")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200711225317.28476-1-laurent.pinchart+renesas@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 4aeb960ccf151..444b77490a42a 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2304,7 +2304,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = {
+ static const struct panel_desc lg_lb070wv8 = {
+ .modes = &lg_lb070wv8_mode,
+ .num_modes = 1,
+- .bpc = 16,
++ .bpc = 8,
+ .size = {
+ .width = 151,
+ .height = 91,
+--
+2.25.1
+
--- /dev/null
+From 5d46ca2746f5617cd9cf49ea24d96d3e9e0029f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 16:36:53 +0100
+Subject: drm/panfrost: Fix inbalance of devfreq record_busy/idle()
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit b99773ef258e628bd53cab22d450a755b73b4d55 ]
+
+The calls to panfrost_devfreq_record_busy() and
+panfrost_devfreq_record_idle() must be balanced to ensure that the
+devfreq utilisation is correctly reported. But there are two cases where
+this doesn't work correctly.
+
+In panfrost_job_hw_submit() if pm_runtime_get_sync() fails or the
+WARN_ON() fires then no call to panfrost_devfreq_record_busy() is made,
+but when the job times out the corresponding _record_idle() call is
+still made in panfrost_job_timedout(). Move the call up to ensure that
+it always happens.
+
+Secondly panfrost_job_timedout() only makes a single call to
+panfrost_devfreq_record_idle() even if it is cleaning up multiple jobs.
+Move the call inside the loop to ensure that the number of
+_record_idle() calls matches the number of _record_busy() calls.
+
+Fixes: 9e62b885f715 ("drm/panfrost: Simplify devfreq utilisation tracking")
+Acked-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200522153653.40754-1-steven.price@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_job.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
+index 7914b15708412..f9519afca29d9 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_job.c
++++ b/drivers/gpu/drm/panfrost/panfrost_job.c
+@@ -145,6 +145,8 @@ static void panfrost_job_hw_submit(struct panfrost_job *job, int js)
+ u64 jc_head = job->jc;
+ int ret;
+
++ panfrost_devfreq_record_busy(pfdev);
++
+ ret = pm_runtime_get_sync(pfdev->dev);
+ if (ret < 0)
+ return;
+@@ -155,7 +157,6 @@ static void panfrost_job_hw_submit(struct panfrost_job *job, int js)
+ }
+
+ cfg = panfrost_mmu_as_get(pfdev, &job->file_priv->mmu);
+- panfrost_devfreq_record_busy(pfdev);
+
+ job_write(pfdev, JS_HEAD_NEXT_LO(js), jc_head & 0xFFFFFFFF);
+ job_write(pfdev, JS_HEAD_NEXT_HI(js), jc_head >> 32);
+@@ -410,12 +411,12 @@ static void panfrost_job_timedout(struct drm_sched_job *sched_job)
+ for (i = 0; i < NUM_JOB_SLOTS; i++) {
+ if (pfdev->jobs[i]) {
+ pm_runtime_put_noidle(pfdev->dev);
++ panfrost_devfreq_record_idle(pfdev);
+ pfdev->jobs[i] = NULL;
+ }
+ }
+ spin_unlock_irqrestore(&pfdev->js->job_lock, flags);
+
+- panfrost_devfreq_record_idle(pfdev);
+ panfrost_device_reset(pfdev);
+
+ for (i = 0; i < NUM_JOB_SLOTS; i++)
+--
+2.25.1
+
--- /dev/null
+From 4588381bf0f78b95a16e5f17c8c5cac0c51177ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 May 2020 10:55:58 +0200
+Subject: drm/radeon: disable AGP by default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit ba806f98f868ce107aa9c453fef751de9980e4af ]
+
+Always use the PCI GART instead. We just have to many cases
+where AGP still causes problems. This means a performance
+regression for some GPUs, but also a bug fix for some others.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_drv.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index 62b5069122cc4..4cd30613fa1dd 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -171,12 +171,7 @@ int radeon_no_wb;
+ int radeon_modeset = -1;
+ int radeon_dynclks = -1;
+ int radeon_r4xx_atom = 0;
+-#ifdef __powerpc__
+-/* Default to PCI on PowerPC (fdo #95017) */
+ int radeon_agpmode = -1;
+-#else
+-int radeon_agpmode = 0;
+-#endif
+ int radeon_vram_limit = 0;
+ int radeon_gart_size = -1; /* auto */
+ int radeon_benchmarking = 0;
+--
+2.25.1
+
--- /dev/null
+From 5d8cde5cbb4a988482112a4bed917154add8c74e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 13:07:10 +0100
+Subject: drm/radeon: fix array out-of-bounds read and write issues
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 7ee78aff9de13d5dccba133f4a0de5367194b243 ]
+
+There is an off-by-one bounds check on the index into arrays
+table->mc_reg_address and table->mc_reg_table_entry[k].mc_data[j] that
+can lead to reads and writes outside of arrays. Fix the bound checking
+off-by-one error.
+
+Addresses-Coverity: ("Out-of-bounds read/write")
+Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/ci_dpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index f434efdeca44d..ba20c6f037198 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -4351,7 +4351,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev,
+ table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
+ }
+ j++;
+- if (j > SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE)
++ if (j >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE)
+ return -EINVAL;
+
+ if (!pi->mem_gddr5) {
+--
+2.25.1
+
--- /dev/null
+From 2dac46498f94096fd16e9c3568b7e155c08abd90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 21:21:22 -0500
+Subject: drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 9fb10671011143d15b6b40d6d5fa9c52c57e9d63 ]
+
+On calling pm_runtime_get_sync() the reference count of the device
+is incremented. In case of failure, decrement the
+reference count before returning the error.
+
+Acked-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 4 +++-
+ drivers/gpu/drm/radeon/radeon_drv.c | 4 +++-
+ drivers/gpu/drm/radeon/radeon_kms.c | 4 +++-
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 35db79a168bf7..df1a7eb736517 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -635,8 +635,10 @@ radeon_crtc_set_config(struct drm_mode_set *set,
+ dev = set->crtc->dev;
+
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ ret = drm_crtc_helper_set_config(set, ctx);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index bbb0883e8ce6a..62b5069122cc4 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -549,8 +549,10 @@ long radeon_drm_ioctl(struct file *filp,
+ long ret;
+ dev = file_priv->minor->dev;
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ ret = drm_ioctl(filp, cmd, arg);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index c5d1dc9618a40..99ee60f8b604d 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -638,8 +638,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+ file_priv->driver_priv = NULL;
+
+ r = pm_runtime_get_sync(dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return r;
++ }
+
+ /* new gpu have virtual address space support */
+ if (rdev->family >= CHIP_CAYMAN) {
+--
+2.25.1
+
--- /dev/null
+From fbcf03182f9417c949a3cb5e689c9eb333c2b416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Feb 2020 23:16:49 +0100
+Subject: drm/stm: repair runtime power management
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit ebd267b2e3c25d5f93a08528b47c036569eb8744 ]
+
+Add missing pm_runtime_get_sync() into ltdc_crtc_atomic_enable() to
+match pm_runtime_put_sync() in ltdc_crtc_atomic_disable(), otherwise
+the LTDC might suspend via runtime PM, disable clock, and then fail
+to resume later on.
+
+The test which triggers it is roughly -- run qt5 application which
+uses eglfs platform and etnaviv, stop the application, sleep for 15
+minutes, run the application again. This leads to a timeout waiting
+for vsync, because the LTDC has suspended, but did not resume.
+
+Fixes: 35ab6cfbf211 ("drm/stm: support runtime power management")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Yannick Fertré <yannick.fertre@st.com>
+Cc: Philippe Cornu <philippe.cornu@st.com>
+Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Cc: Vincent Abriou <vincent.abriou@st.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+To: dri-devel@lists.freedesktop.org
+Cc: linux-stm32@st-md-mailman.stormreply.com
+Cc: linux-arm-kernel@lists.infradead.org
+Acked-by: Philippe Cornu <philippe.cornu@st.com>
+Tested-by: Yannick Fertre <yannick.fertre@st.com>
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@st.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200229221649.90813-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/stm/ltdc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
+index f894968d6e452..3f590d916e916 100644
+--- a/drivers/gpu/drm/stm/ltdc.c
++++ b/drivers/gpu/drm/stm/ltdc.c
+@@ -423,9 +423,12 @@ static void ltdc_crtc_atomic_enable(struct drm_crtc *crtc,
+ struct drm_crtc_state *old_state)
+ {
+ struct ltdc_device *ldev = crtc_to_ltdc(crtc);
++ struct drm_device *ddev = crtc->dev;
+
+ DRM_DEBUG_DRIVER("\n");
+
++ pm_runtime_get_sync(ddev->dev);
++
+ /* Sets the background color value */
+ reg_write(ldev->regs, LTDC_BCCR, BCCR_BCBLACK);
+
+--
+2.25.1
+
--- /dev/null
+From c2cf7ba2c76eeda3705ad22a99537ce332ac6137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Apr 2020 13:42:32 +0300
+Subject: drm/tilcdc: fix leak & null ref in panel_connector_get_modes
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+[ Upstream commit 3f9c1c872cc97875ddc8d63bc9fe6ee13652b933 ]
+
+If videomode_from_timings() returns true, the mode allocated with
+drm_mode_create will be leaked.
+
+Also, the return value of drm_mode_create() is never checked, and thus
+could cause NULL deref.
+
+Fix these two issues.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200429104234.18910-1-tomi.valkeinen@ti.com
+Reviewed-by: Jyri Sarha <jsarha@ti.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+index 12823d60c4e89..4be53768f0146 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+@@ -139,12 +139,16 @@ static int panel_connector_get_modes(struct drm_connector *connector)
+ int i;
+
+ for (i = 0; i < timings->num_timings; i++) {
+- struct drm_display_mode *mode = drm_mode_create(dev);
++ struct drm_display_mode *mode;
+ struct videomode vm;
+
+ if (videomode_from_timings(timings, &vm, i))
+ break;
+
++ mode = drm_mode_create(dev);
++ if (!mode)
++ break;
++
+ drm_display_mode_from_videomode(&vm, mode);
+
+ mode->type = DRM_MODE_TYPE_DRIVER;
+--
+2.25.1
+
--- /dev/null
+From 01d85878ebfd25b46c0de08c2e81fe5aa9b313b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 17:57:44 +0900
+Subject: dt-bindings: phy: uniphier: Fix incorrect clocks and clock-names for
+ PXs3 usb3-hsphy
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 03815930c162561a5c204494b4160d6ccf631b0b ]
+
+The usb3-hsphy for PXs3 SoC needs to accept 3 clocks like usb3-ssphy.
+
+Fixes: 134ab2845acb ("dt-bindings: phy: Convert UniPhier USB3-PHY conroller to json-schema")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Link: https://lore.kernel.org/r/1594198664-29381-1-git-send-email-hayashi.kunihiko@socionext.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/phy/socionext,uniphier-usb3hs-phy.yaml | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/phy/socionext,uniphier-usb3hs-phy.yaml b/Documentation/devicetree/bindings/phy/socionext,uniphier-usb3hs-phy.yaml
+index f88d36207b87e..c871d462c9523 100644
+--- a/Documentation/devicetree/bindings/phy/socionext,uniphier-usb3hs-phy.yaml
++++ b/Documentation/devicetree/bindings/phy/socionext,uniphier-usb3hs-phy.yaml
+@@ -31,12 +31,16 @@ properties:
+
+ clocks:
+ minItems: 1
+- maxItems: 2
++ maxItems: 3
+
+ clock-names:
+ oneOf:
+ - const: link # for PXs2
+- - items: # for PXs3
++ - items: # for PXs3 with phy-ext
++ - const: link
++ - const: phy
++ - const: phy-ext
++ - items: # for others
+ - const: link
+ - const: phy
+
+--
+2.25.1
+
--- /dev/null
+From 6409700cd3201abab5e846e2d9b50c58e5b77128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jul 2020 17:10:47 -0600
+Subject: dyndbg: fix a BUG_ON in ddebug_describe_flags
+
+From: Jim Cromie <jim.cromie@gmail.com>
+
+[ Upstream commit f678ce8cc3cb2ad29df75d8824c74f36398ba871 ]
+
+ddebug_describe_flags() currently fills a caller provided string buffer,
+after testing its size (also passed) in a BUG_ON. Fix this by
+replacing them with a known-big-enough string buffer wrapped in a
+struct, and passing that instead.
+
+Also simplify ddebug_describe_flags() flags parameter from a struct to
+a member in that struct, and hoist the member deref up to the caller.
+This makes the function reusable (soon) where flags are unpacked.
+
+Acked-by: <jbaron@akamai.com>
+Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
+Link: https://lore.kernel.org/r/20200719231058.1586423-8-jim.cromie@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/dynamic_debug.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
+index 321437bbf87dd..98876a8255c7d 100644
+--- a/lib/dynamic_debug.c
++++ b/lib/dynamic_debug.c
+@@ -87,22 +87,22 @@ static struct { unsigned flag:8; char opt_char; } opt_array[] = {
+ { _DPRINTK_FLAGS_NONE, '_' },
+ };
+
++struct flagsbuf { char buf[ARRAY_SIZE(opt_array)+1]; };
++
+ /* format a string into buf[] which describes the _ddebug's flags */
+-static char *ddebug_describe_flags(struct _ddebug *dp, char *buf,
+- size_t maxlen)
++static char *ddebug_describe_flags(unsigned int flags, struct flagsbuf *fb)
+ {
+- char *p = buf;
++ char *p = fb->buf;
+ int i;
+
+- BUG_ON(maxlen < 6);
+ for (i = 0; i < ARRAY_SIZE(opt_array); ++i)
+- if (dp->flags & opt_array[i].flag)
++ if (flags & opt_array[i].flag)
+ *p++ = opt_array[i].opt_char;
+- if (p == buf)
++ if (p == fb->buf)
+ *p++ = '_';
+ *p = '\0';
+
+- return buf;
++ return fb->buf;
+ }
+
+ #define vpr_info(fmt, ...) \
+@@ -144,7 +144,7 @@ static int ddebug_change(const struct ddebug_query *query,
+ struct ddebug_table *dt;
+ unsigned int newflags;
+ unsigned int nfound = 0;
+- char flagbuf[10];
++ struct flagsbuf fbuf;
+
+ /* search for matching ddebugs */
+ mutex_lock(&ddebug_lock);
+@@ -201,8 +201,7 @@ static int ddebug_change(const struct ddebug_query *query,
+ vpr_info("changed %s:%d [%s]%s =%s\n",
+ trim_prefix(dp->filename), dp->lineno,
+ dt->mod_name, dp->function,
+- ddebug_describe_flags(dp, flagbuf,
+- sizeof(flagbuf)));
++ ddebug_describe_flags(dp->flags, &fbuf));
+ }
+ }
+ mutex_unlock(&ddebug_lock);
+@@ -816,7 +815,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p)
+ {
+ struct ddebug_iter *iter = m->private;
+ struct _ddebug *dp = p;
+- char flagsbuf[10];
++ struct flagsbuf flags;
+
+ vpr_info("called m=%p p=%p\n", m, p);
+
+@@ -829,7 +828,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p)
+ seq_printf(m, "%s:%u [%s]%s =%s \"",
+ trim_prefix(dp->filename), dp->lineno,
+ iter->table->mod_name, dp->function,
+- ddebug_describe_flags(dp, flagsbuf, sizeof(flagsbuf)));
++ ddebug_describe_flags(dp->flags, &flags));
+ seq_escape(m, dp->format, "\t\r\n\"");
+ seq_puts(m, "\"\n");
+
+--
+2.25.1
+
--- /dev/null
+From 56b493f1f7a76a626c66c5bdf01259130019b677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 15:22:37 -0500
+Subject: EDAC: Fix reference count leaks
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit 17ed808ad243192fb923e4e653c1338d3ba06207 ]
+
+When kobject_init_and_add() returns an error, it should be handled
+because kobject_init_and_add() takes a reference even when it fails. If
+this function returns an error, kobject_put() must be called to properly
+clean up the memory associated with the object.
+
+Therefore, replace calling kfree() and call kobject_put() and add a
+missing kobject_put() in the edac_device_register_sysfs_main_kobj()
+error path.
+
+ [ bp: Massage and merge into a single patch. ]
+
+Fixes: b2ed215a3338 ("Kobject: change drivers/edac to use kobject_init_and_add")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20200528202238.18078-1-wu000273@umn.edu
+Link: https://lkml.kernel.org/r/20200528203526.20908-1-wu000273@umn.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/edac_device_sysfs.c | 1 +
+ drivers/edac/edac_pci_sysfs.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
+index 0e7ea3591b781..5e75937537997 100644
+--- a/drivers/edac/edac_device_sysfs.c
++++ b/drivers/edac/edac_device_sysfs.c
+@@ -275,6 +275,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
+
+ /* Error exit stack */
+ err_kobj_reg:
++ kobject_put(&edac_dev->kobj);
+ module_put(edac_dev->owner);
+
+ err_out:
+diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
+index 72c9eb9fdffbe..53042af7262e2 100644
+--- a/drivers/edac/edac_pci_sysfs.c
++++ b/drivers/edac/edac_pci_sysfs.c
+@@ -386,7 +386,7 @@ static int edac_pci_main_kobj_setup(void)
+
+ /* Error unwind statck */
+ kobject_init_and_add_fail:
+- kfree(edac_pci_top_main_kobj);
++ kobject_put(edac_pci_top_main_kobj);
+
+ kzalloc_fail:
+ module_put(THIS_MODULE);
+--
+2.25.1
+
--- /dev/null
+From 9b1710be8a1acaf5b9249375c314385f7b4caa18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 23:03:30 +0100
+Subject: firmware: arm_scmi: Fix SCMI genpd domain probing
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit e0f1a30cf184821499eeb67daedd7a3f21bbcb0b ]
+
+When, at probe time, an SCMI communication failure inhibits the capacity
+to query power domains states, such domains should be skipped.
+
+Registering partially initialized SCMI power domains with genpd will
+causes kernel panic.
+
+ arm-scmi timed out in resp(caller: scmi_power_state_get+0xa4/0xd0)
+ scmi-power-domain scmi_dev.2: failed to get state for domain 9
+ Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+ Mem abort info:
+ ESR = 0x96000006
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ Data abort info:
+ ISV = 0, ISS = 0x00000006
+ CM = 0, WnR = 0
+ user pgtable: 4k pages, 48-bit VAs, pgdp=00000009f3691000
+ [0000000000000000] pgd=00000009f1ca0003, p4d=00000009f1ca0003, pud=00000009f35ea003, pmd=0000000000000000
+ Internal error: Oops: 96000006 [#1] PREEMPT SMP
+ CPU: 2 PID: 381 Comm: bash Not tainted 5.8.0-rc1-00011-gebd118c2cca8 #2
+ Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Jan 3 2020
+ Internal error: Oops: 96000006 [#1] PREEMPT SMP
+ pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--)
+ pc : of_genpd_add_provider_onecell+0x98/0x1f8
+ lr : of_genpd_add_provider_onecell+0x48/0x1f8
+ Call trace:
+ of_genpd_add_provider_onecell+0x98/0x1f8
+ scmi_pm_domain_probe+0x174/0x1e8
+ scmi_dev_probe+0x90/0xe0
+ really_probe+0xe4/0x448
+ driver_probe_device+0xfc/0x168
+ device_driver_attach+0x7c/0x88
+ bind_store+0xe8/0x128
+ drv_attr_store+0x2c/0x40
+ sysfs_kf_write+0x4c/0x60
+ kernfs_fop_write+0x114/0x230
+ __vfs_write+0x24/0x50
+ vfs_write+0xbc/0x1e0
+ ksys_write+0x70/0xf8
+ __arm64_sys_write+0x24/0x30
+ el0_svc_common.constprop.3+0x94/0x160
+ do_el0_svc+0x2c/0x98
+ el0_sync_handler+0x148/0x1a8
+ el0_sync+0x158/0x180
+
+Do not register any power domain that failed to be queried with genpd.
+
+Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd")
+Link: https://lore.kernel.org/r/20200619220330.12217-1-cristian.marussi@arm.com
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/scmi_pm_domain.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+index bafbfe358f97d..9e44479f02842 100644
+--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+@@ -85,7 +85,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ for (i = 0; i < num_domains; i++, scmi_pd++) {
+ u32 state;
+
+- domains[i] = &scmi_pd->genpd;
++ if (handle->power_ops->state_get(handle, i, &state)) {
++ dev_warn(dev, "failed to get state for domain %d\n", i);
++ continue;
++ }
+
+ scmi_pd->domain = i;
+ scmi_pd->handle = handle;
+@@ -94,13 +97,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ scmi_pd->genpd.power_off = scmi_pd_power_off;
+ scmi_pd->genpd.power_on = scmi_pd_power_on;
+
+- if (handle->power_ops->state_get(handle, i, &state)) {
+- dev_warn(dev, "failed to get state for domain %d\n", i);
+- continue;
+- }
+-
+ pm_genpd_init(&scmi_pd->genpd, NULL,
+ state == SCMI_POWER_STATE_GENERIC_OFF);
++
++ domains[i] = &scmi_pd->genpd;
+ }
+
+ scmi_pd_data->domains = domains;
+--
+2.25.1
+
--- /dev/null
+From a56abe0e15136b4a76751791f00b65810cb8ebc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 May 2020 14:15:37 -0700
+Subject: fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 9f47eb5461aaeb6cb8696f9d11503ae90e4d5cb0 ]
+
+Very large I/Os can cause the following RCU CPU stall warning:
+
+RIP: 0010:rb_prev+0x8/0x50
+Code: 49 89 c0 49 89 d1 48 89 c2 48 89 f8 e9 e5 fd ff ff 4c 89 48 10 c3 4c =
+89 06 c3 4c 89 40 10 c3 0f 1f 00 48 8b 0f 48 39 cf 74 38 <48> 8b 47 10 48 85 c0 74 22 48 8b 50 08 48 85 d2 74 0c 48 89 d0 48
+RSP: 0018:ffffc9002212bab0 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff13
+RAX: ffff888821f93630 RBX: ffff888821f93630 RCX: ffff888821f937e0
+RDX: 0000000000000000 RSI: 0000000000102000 RDI: ffff888821f93630
+RBP: 0000000000103000 R08: 000000000006c000 R09: 0000000000000238
+R10: 0000000000102fff R11: ffffc9002212bac8 R12: 0000000000000001
+R13: ffffffffffffffff R14: 0000000000102000 R15: ffff888821f937e0
+ __lookup_extent_mapping+0xa0/0x110
+ try_release_extent_mapping+0xdc/0x220
+ btrfs_releasepage+0x45/0x70
+ shrink_page_list+0xa39/0xb30
+ shrink_inactive_list+0x18f/0x3b0
+ shrink_lruvec+0x38e/0x6b0
+ shrink_node+0x14d/0x690
+ do_try_to_free_pages+0xc6/0x3e0
+ try_to_free_mem_cgroup_pages+0xe6/0x1e0
+ reclaim_high.constprop.73+0x87/0xc0
+ mem_cgroup_handle_over_high+0x66/0x150
+ exit_to_usermode_loop+0x82/0xd0
+ do_syscall_64+0xd4/0x100
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+On a PREEMPT=n kernel, the try_release_extent_mapping() function's
+"while" loop might run for a very long time on a large I/O. This commit
+therefore adds a cond_resched() to this loop, providing RCU any needed
+quiescent states.
+
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent_io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 60278e52c37ab..eeaee346f5a95 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4516,6 +4516,8 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)
+
+ /* once for us */
+ free_extent_map(em);
++
++ cond_resched(); /* Allow large-extent preemption. */
+ }
+ }
+ return try_release_extent_state(tree, page, mask);
+--
+2.25.1
+
--- /dev/null
+From c6b1166e5e75f32dd20e5a4b8f10b407d86ecd09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 10:07:33 +0300
+Subject: fsl/fman: check dereferencing null pointer
+
+From: Florinel Iordache <florinel.iordache@nxp.com>
+
+[ Upstream commit cc5d229a122106733a85c279d89d7703f21e4d4f ]
+
+Add a safe check to avoid dereferencing null pointer
+
+Fixes: 57ba4c9b56d8 ("fsl/fman: Add FMan MAC support")
+Signed-off-by: Florinel Iordache <florinel.iordache@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_dtsec.c | 4 ++--
+ drivers/net/ethernet/freescale/fman/fman_memac.c | 2 +-
+ drivers/net/ethernet/freescale/fman/fman_tgec.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+index 004c266802a87..bce3c9398887c 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
++++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+@@ -1200,7 +1200,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr)
+ list_for_each(pos,
+ &dtsec->multicast_addr_hash->lsts[bucket]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+@@ -1213,7 +1213,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr)
+ list_for_each(pos,
+ &dtsec->unicast_addr_hash->lsts[bucket]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index bb02b37422cc2..645764abdaae5 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -981,7 +981,7 @@ int memac_del_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr)
+
+ list_for_each(pos, &memac->multicast_addr_hash->lsts[hash]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+index 8c7eb878d5b43..41946b16f6c72 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
++++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+@@ -626,7 +626,7 @@ int tgec_del_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr)
+
+ list_for_each(pos, &tgec->multicast_addr_hash->lsts[hash]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+--
+2.25.1
+
--- /dev/null
+From 1ed2cec5e030072dfa4c12facfce17fc98ab63ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 10:07:31 +0300
+Subject: fsl/fman: fix dereference null return value
+
+From: Florinel Iordache <florinel.iordache@nxp.com>
+
+[ Upstream commit 0572054617f32670abab4b4e89a876954d54b704 ]
+
+Check before using returned value to avoid dereferencing null pointer.
+
+Fixes: 18a6c85fcc78 ("fsl/fman: Add FMan Port Support")
+Signed-off-by: Florinel Iordache <florinel.iordache@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_port.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c
+index 87b26f063cc82..c27df153f8959 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_port.c
++++ b/drivers/net/ethernet/freescale/fman/fman_port.c
+@@ -1767,6 +1767,7 @@ static int fman_port_probe(struct platform_device *of_dev)
+ struct fman_port *port;
+ struct fman *fman;
+ struct device_node *fm_node, *port_node;
++ struct platform_device *fm_pdev;
+ struct resource res;
+ struct resource *dev_res;
+ u32 val;
+@@ -1791,8 +1792,14 @@ static int fman_port_probe(struct platform_device *of_dev)
+ goto return_err;
+ }
+
+- fman = dev_get_drvdata(&of_find_device_by_node(fm_node)->dev);
++ fm_pdev = of_find_device_by_node(fm_node);
+ of_node_put(fm_node);
++ if (!fm_pdev) {
++ err = -EINVAL;
++ goto return_err;
++ }
++
++ fman = dev_get_drvdata(&fm_pdev->dev);
+ if (!fman) {
+ err = -EINVAL;
+ goto return_err;
+--
+2.25.1
+
--- /dev/null
+From cbe53d68b6a75ae0bb748b7d4cf2b77a155dc00d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 10:07:34 +0300
+Subject: fsl/fman: fix eth hash table allocation
+
+From: Florinel Iordache <florinel.iordache@nxp.com>
+
+[ Upstream commit 3207f715c34317d08e798e11a10ce816feb53c0f ]
+
+Fix memory allocation for ethernet address hash table.
+The code was wrongly allocating an array for eth hash table which
+is incorrect because this is the main structure for eth hash table
+(struct eth_hash_t) that contains inside a number of elements.
+
+Fixes: 57ba4c9b56d8 ("fsl/fman: Add FMan MAC support")
+Signed-off-by: Florinel Iordache <florinel.iordache@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_mac.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_mac.h b/drivers/net/ethernet/freescale/fman/fman_mac.h
+index dd6d0526f6c1f..19f327efdaff3 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_mac.h
++++ b/drivers/net/ethernet/freescale/fman/fman_mac.h
+@@ -252,7 +252,7 @@ static inline struct eth_hash_t *alloc_hash_table(u16 size)
+ struct eth_hash_t *hash;
+
+ /* Allocate address hash table */
+- hash = kmalloc_array(size, sizeof(struct eth_hash_t *), GFP_KERNEL);
++ hash = kmalloc(sizeof(*hash), GFP_KERNEL);
+ if (!hash)
+ return NULL;
+
+--
+2.25.1
+
--- /dev/null
+From 521c34f730baa10bf486b8133a2748cb16da92ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 10:07:32 +0300
+Subject: fsl/fman: fix unreachable code
+
+From: Florinel Iordache <florinel.iordache@nxp.com>
+
+[ Upstream commit cc79fd8f557767de90ff199d3b6fb911df43160a ]
+
+The parameter 'priority' is incorrectly forced to zero which ultimately
+induces logically dead code in the subsequent lines.
+
+Fixes: 57ba4c9b56d8 ("fsl/fman: Add FMan MAC support")
+Signed-off-by: Florinel Iordache <florinel.iordache@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_memac.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index a5500ede40703..bb02b37422cc2 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -852,7 +852,6 @@ int memac_set_tx_pause_frames(struct fman_mac *memac, u8 priority,
+
+ tmp = ioread32be(®s->command_config);
+ tmp &= ~CMD_CFG_PFC_MODE;
+- priority = 0;
+
+ iowrite32be(tmp, ®s->command_config);
+
+--
+2.25.1
+
--- /dev/null
+From 70e6c3e89ead47e0cfd1d0427f0d55c933893f74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 10:07:30 +0300
+Subject: fsl/fman: use 32-bit unsigned integer
+
+From: Florinel Iordache <florinel.iordache@nxp.com>
+
+[ Upstream commit 99f47abd9f7bf6e365820d355dc98f6955a562df ]
+
+Potentially overflowing expression (ts_freq << 16 and intgr << 16)
+declared as type u32 (32-bit unsigned) is evaluated using 32-bit
+arithmetic and then used in a context that expects an expression of
+type u64 (64-bit unsigned) which ultimately is used as 16-bit
+unsigned by typecasting to u16. Fixed by using an unsigned 32-bit
+integer since the value is truncated anyway in the end.
+
+Fixes: 414fd46e7762 ("fsl/fman: Add FMan support")
+Signed-off-by: Florinel Iordache <florinel.iordache@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
+index f151d6e111dd9..ef67e8599b393 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -1398,8 +1398,7 @@ static void enable_time_stamp(struct fman *fman)
+ {
+ struct fman_fpm_regs __iomem *fpm_rg = fman->fpm_regs;
+ u16 fm_clk_freq = fman->state->fm_clk_freq;
+- u32 tmp, intgr, ts_freq;
+- u64 frac;
++ u32 tmp, intgr, ts_freq, frac;
+
+ ts_freq = (u32)(1 << fman->state->count1_micro_bit);
+ /* configure timestamp so that bit 8 will count 1 microsecond
+--
+2.25.1
+
--- /dev/null
+From 19b2d30ba2f1d65352142636de8ad448c18b9787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 20:50:48 -0400
+Subject: ftrace: Fix ftrace_trace_task return value
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit c58b6b0372de0d4cd0536d6585addd1b36b151ae ]
+
+I was attempting to use pid filtering with function_graph, but it wasn't
+allowing anything to make it through. Turns out ftrace_trace_task
+returns false if ftrace_ignore_pid is not-empty, which isn't correct
+anymore. We're now setting it to FTRACE_PID_IGNORE if we need to ignore
+that pid, otherwise it's set to the pid (which is weird considering the
+name) or to FTRACE_PID_TRACE. Fix the check to check for !=
+FTRACE_PID_IGNORE. With this we can now use function_graph with pid
+filtering.
+
+Link: https://lkml.kernel.org/r/20200725005048.1790-1-josef@toxicpanda.com
+
+Fixes: 717e3f5ebc82 ("ftrace: Make function trace pid filtering a bit more exact")
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 3 ---
+ kernel/trace/trace.h | 7 ++++++-
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 1903b80db6ebc..7d879fae3777f 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -139,9 +139,6 @@ static inline void ftrace_ops_init(struct ftrace_ops *ops)
+ #endif
+ }
+
+-#define FTRACE_PID_IGNORE -1
+-#define FTRACE_PID_TRACE -2
+-
+ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
+ struct ftrace_ops *op, struct pt_regs *regs)
+ {
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index f21607f871891..610d21355526d 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -1103,6 +1103,10 @@ print_graph_function_flags(struct trace_iterator *iter, u32 flags)
+ extern struct list_head ftrace_pids;
+
+ #ifdef CONFIG_FUNCTION_TRACER
++
++#define FTRACE_PID_IGNORE -1
++#define FTRACE_PID_TRACE -2
++
+ struct ftrace_func_command {
+ struct list_head list;
+ char *name;
+@@ -1114,7 +1118,8 @@ struct ftrace_func_command {
+ extern bool ftrace_filter_param __initdata;
+ static inline int ftrace_trace_task(struct trace_array *tr)
+ {
+- return !this_cpu_read(tr->array_buffer.data->ftrace_ignore_pid);
++ return this_cpu_read(tr->array_buffer.data->ftrace_ignore_pid) !=
++ FTRACE_PID_IGNORE;
+ }
+ extern int ftrace_is_dead(void);
+ int ftrace_create_function_files(struct trace_array *tr,
+--
+2.25.1
+
--- /dev/null
+From 17a45c96f87062a745b2fff7a4f0f92bcc037757 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 May 2020 12:50:33 +0200
+Subject: go7007: add sanity checking for endpoints
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit 137641287eb40260783a4413847a0aef06023a6c ]
+
+A malicious USB device may lack endpoints the driver assumes to exist
+Accessing them leads to NULL pointer accesses. This patch introduces
+sanity checking.
+
+Reported-and-tested-by: syzbot+cabfa4b5b05ff6be4ef0@syzkaller.appspotmail.com
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-usb.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
+index f889c9d740cd1..dbf0455d5d50d 100644
+--- a/drivers/media/usb/go7007/go7007-usb.c
++++ b/drivers/media/usb/go7007/go7007-usb.c
+@@ -1132,6 +1132,10 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ go->hpi_ops = &go7007_usb_onboard_hpi_ops;
+ go->hpi_context = usb;
+
++ ep = usb->usbdev->ep_in[4];
++ if (!ep)
++ return -ENODEV;
++
+ /* Allocate the URB and buffer for receiving incoming interrupts */
+ usb->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (usb->intr_urb == NULL)
+@@ -1141,7 +1145,6 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ if (usb->intr_urb->transfer_buffer == NULL)
+ goto allocfail;
+
+- ep = usb->usbdev->ep_in[4];
+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+ usb_fill_bulk_urb(usb->intr_urb, usb->usbdev,
+ usb_rcvbulkpipe(usb->usbdev, 4),
+@@ -1263,9 +1266,13 @@ static int go7007_usb_probe(struct usb_interface *intf,
+
+ /* Allocate the URBs and buffers for receiving the video stream */
+ if (board->flags & GO7007_USB_EZUSB) {
++ if (!usb->usbdev->ep_in[6])
++ goto allocfail;
+ v_urb_len = 1024;
+ video_pipe = usb_rcvbulkpipe(usb->usbdev, 6);
+ } else {
++ if (!usb->usbdev->ep_in[1])
++ goto allocfail;
+ v_urb_len = 512;
+ video_pipe = usb_rcvbulkpipe(usb->usbdev, 1);
+ }
+@@ -1285,6 +1292,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ /* Allocate the URBs and buffers for receiving the audio stream */
+ if ((board->flags & GO7007_USB_EZUSB) &&
+ (board->main_info.flags & GO7007_BOARD_HAS_AUDIO)) {
++ if (!usb->usbdev->ep_in[8])
++ goto allocfail;
+ for (i = 0; i < 8; ++i) {
+ usb->audio_urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
+ if (usb->audio_urbs[i] == NULL)
+--
+2.25.1
+
--- /dev/null
+From 18cf42270736a2debab660c08f99d7dee393abdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 14:38:36 +0200
+Subject: gpio: don't use same lockdep class for all devm_gpiochip_add_data
+ users
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit 5f402bb17533113c21d61c2d4bc4ef4a6fa1c9a5 ]
+
+Commit 959bc7b22bd2 ("gpio: Automatically add lockdep keys") documents
+in its commits message its intention to "create a unique class key for
+each driver".
+
+It does so by having gpiochip_add_data add in-place the definition of
+two static lockdep classes for LOCKDEP use. That way, every caller of
+the macro adds their gpiochip with unique lockdep classes.
+
+There are many indirect callers of gpiochip_add_data, however, via
+use of devm_gpiochip_add_data. devm_gpiochip_add_data has external
+linkage and all its users will share the same lockdep classes, which
+probably is not intended.
+
+Fix this by replicating the gpio_chip_add_data statics-in-macro for
+the devm_ version as well.
+
+Fixes: 959bc7b22bd2 ("gpio: Automatically add lockdep keys")
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Link: https://lore.kernel.org/r/20200731123835.8003-1-a.fatoum@pengutronix.de
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-devres.c | 13 ++++++++-----
+ include/linux/gpio/driver.h | 13 +++++++++++--
+ 2 files changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-devres.c b/drivers/gpio/gpiolib-devres.c
+index 5c91c4365da1f..7dbce4c4ebdf4 100644
+--- a/drivers/gpio/gpiolib-devres.c
++++ b/drivers/gpio/gpiolib-devres.c
+@@ -487,10 +487,12 @@ static void devm_gpio_chip_release(struct device *dev, void *res)
+ }
+
+ /**
+- * devm_gpiochip_add_data() - Resource managed gpiochip_add_data()
++ * devm_gpiochip_add_data_with_key() - Resource managed gpiochip_add_data_with_key()
+ * @dev: pointer to the device that gpio_chip belongs to.
+ * @gc: the GPIO chip to register
+ * @data: driver-private data associated with this chip
++ * @lock_key: lockdep class for IRQ lock
++ * @request_key: lockdep class for IRQ request
+ *
+ * Context: potentially before irqs will work
+ *
+@@ -501,8 +503,9 @@ static void devm_gpio_chip_release(struct device *dev, void *res)
+ * gc->base is invalid or already associated with a different chip.
+ * Otherwise it returns zero as a success code.
+ */
+-int devm_gpiochip_add_data(struct device *dev, struct gpio_chip *gc,
+- void *data)
++int devm_gpiochip_add_data_with_key(struct device *dev, struct gpio_chip *gc, void *data,
++ struct lock_class_key *lock_key,
++ struct lock_class_key *request_key)
+ {
+ struct gpio_chip **ptr;
+ int ret;
+@@ -512,7 +515,7 @@ int devm_gpiochip_add_data(struct device *dev, struct gpio_chip *gc,
+ if (!ptr)
+ return -ENOMEM;
+
+- ret = gpiochip_add_data(gc, data);
++ ret = gpiochip_add_data_with_key(gc, data, lock_key, request_key);
+ if (ret < 0) {
+ devres_free(ptr);
+ return ret;
+@@ -523,4 +526,4 @@ int devm_gpiochip_add_data(struct device *dev, struct gpio_chip *gc,
+
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(devm_gpiochip_add_data);
++EXPORT_SYMBOL_GPL(devm_gpiochip_add_data_with_key);
+diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
+index c4f272af7af59..e6217d8e2e9f6 100644
+--- a/include/linux/gpio/driver.h
++++ b/include/linux/gpio/driver.h
+@@ -509,8 +509,16 @@ extern int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ gpiochip_add_data_with_key(gc, data, &lock_key, \
+ &request_key); \
+ })
++#define devm_gpiochip_add_data(dev, gc, data) ({ \
++ static struct lock_class_key lock_key; \
++ static struct lock_class_key request_key; \
++ devm_gpiochip_add_data_with_key(dev, gc, data, &lock_key, \
++ &request_key); \
++ })
+ #else
+ #define gpiochip_add_data(gc, data) gpiochip_add_data_with_key(gc, data, NULL, NULL)
++#define devm_gpiochip_add_data(dev, gc, data) \
++ devm_gpiochip_add_data_with_key(dev, gc, data, NULL, NULL)
+ #endif /* CONFIG_LOCKDEP */
+
+ static inline int gpiochip_add(struct gpio_chip *gc)
+@@ -518,8 +526,9 @@ static inline int gpiochip_add(struct gpio_chip *gc)
+ return gpiochip_add_data(gc, NULL);
+ }
+ extern void gpiochip_remove(struct gpio_chip *gc);
+-extern int devm_gpiochip_add_data(struct device *dev, struct gpio_chip *gc,
+- void *data);
++extern int devm_gpiochip_add_data_with_key(struct device *dev, struct gpio_chip *gc, void *data,
++ struct lock_class_key *lock_key,
++ struct lock_class_key *request_key);
+
+ extern struct gpio_chip *gpiochip_find(void *data,
+ int (*match)(struct gpio_chip *gc, void *data));
+--
+2.25.1
+
--- /dev/null
+From 315b12192b071df7b62120c461a51254482af359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 01:23:37 +0200
+Subject: gpio: regmap: fix type clash
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit a070bdbbb06d7787ec7844a4f1e059cf8b55205d ]
+
+GPIO_REGMAP_ADDR_ZERO() cast to unsigned long but the actual config
+parameters are unsigned int. We use unsigned int here because that is
+the type which is used by the underlying regmap.
+
+Fixes: ebe363197e52 ("gpio: add a reusable generic gpio_chip using regmap")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Michael Walle <michael@walle.cc>
+Link: https://lore.kernel.org/r/20200725232337.27581-1-michael@walle.cc
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/regmap.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/gpio/regmap.h b/include/linux/gpio/regmap.h
+index 4c1e6b34e8249..ad76f3d0a6ba1 100644
+--- a/include/linux/gpio/regmap.h
++++ b/include/linux/gpio/regmap.h
+@@ -8,7 +8,7 @@ struct gpio_regmap;
+ struct irq_domain;
+ struct regmap;
+
+-#define GPIO_REGMAP_ADDR_ZERO ((unsigned long)(-1))
++#define GPIO_REGMAP_ADDR_ZERO ((unsigned int)(-1))
+ #define GPIO_REGMAP_ADDR(addr) ((addr) ? : GPIO_REGMAP_ADDR_ZERO)
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From fd3c2d2727c77fa768edca3b92584e56356222ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 06:18:41 +0300
+Subject: gpu: host1x: debug: Fix multiple channels emitting messages
+ simultaneously
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 35681862808472a0a4b9a8817ae2789c0b5b3edc ]
+
+Once channel's job is hung, it dumps the channel's state into KMSG before
+tearing down the offending job. If multiple channels hang at once, then
+they dump messages simultaneously, making the debug info unreadable, and
+thus, useless. This patch adds mutex which allows only one channel to emit
+debug messages at a time.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/debug.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/host1x/debug.c b/drivers/gpu/host1x/debug.c
+index c0392672a8421..1b4997bda1c79 100644
+--- a/drivers/gpu/host1x/debug.c
++++ b/drivers/gpu/host1x/debug.c
+@@ -16,6 +16,8 @@
+ #include "debug.h"
+ #include "channel.h"
+
++static DEFINE_MUTEX(debug_lock);
++
+ unsigned int host1x_debug_trace_cmdbuf;
+
+ static pid_t host1x_debug_force_timeout_pid;
+@@ -52,12 +54,14 @@ static int show_channel(struct host1x_channel *ch, void *data, bool show_fifo)
+ struct output *o = data;
+
+ mutex_lock(&ch->cdma.lock);
++ mutex_lock(&debug_lock);
+
+ if (show_fifo)
+ host1x_hw_show_channel_fifo(m, ch, o);
+
+ host1x_hw_show_channel_cdma(m, ch, o);
+
++ mutex_unlock(&debug_lock);
+ mutex_unlock(&ch->cdma.lock);
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 87d857b178588ebb8af3570327a04053f015eea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 15:40:36 -0700
+Subject: gpu: ipu-v3: Restore RGB32, BGR32
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+[ Upstream commit 22b2cfad752d4b278ea7c38c0ee961ca50198ce8 ]
+
+RGB32 and BGR32 formats were inadvertently removed from the switch
+statement in ipu_pixelformat_to_colorspace(). Restore them.
+
+Fixes: a59957172b0c ("gpu: ipu-v3: enable remaining 32-bit RGB V4L2 pixel formats")
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index ee2a025e54cfe..b3dae9ec1a38b 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -124,6 +124,8 @@ enum ipu_color_space ipu_pixelformat_to_colorspace(u32 pixelformat)
+ case V4L2_PIX_FMT_RGBX32:
+ case V4L2_PIX_FMT_ARGB32:
+ case V4L2_PIX_FMT_XRGB32:
++ case V4L2_PIX_FMT_RGB32:
++ case V4L2_PIX_FMT_BGR32:
+ return IPUV3_COLORSPACE_RGB;
+ default:
+ return IPUV3_COLORSPACE_UNKNOWN;
+--
+2.25.1
+
--- /dev/null
+From 2c1fb4516b0c5ecef12fa299aa700ebfce05b702 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 09:54:15 -0700
+Subject: hv_netvsc: do not use VF device if link is down
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 7c9864bbccc23e1812ac82966555d68c13ea4006 ]
+
+If the accelerated networking SRIOV VF device has lost carrier
+use the synthetic network device which is available as backup
+path. This is a rare case since if VF link goes down, normally
+the VMBus device will also loose external connectivity as well.
+But if the communication is between two VM's on the same host
+the VMBus device will still work.
+
+Reported-by: "Shah, Ashish N" <ashish.n.shah@intel.com>
+Fixes: 0c195567a8f6 ("netvsc: transparent VF management")
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc_drv.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 6267f706e8ee6..0d779bba1b019 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -532,12 +532,13 @@ static int netvsc_xmit(struct sk_buff *skb, struct net_device *net, bool xdp_tx)
+ u32 hash;
+ struct hv_page_buffer pb[MAX_PAGE_BUFFER_COUNT];
+
+- /* if VF is present and up then redirect packets
+- * already called with rcu_read_lock_bh
++ /* If VF is present and up then redirect packets to it.
++ * Skip the VF if it is marked down or has no carrier.
++ * If netpoll is in uses, then VF can not be used either.
+ */
+ vf_netdev = rcu_dereference_bh(net_device_ctx->vf_netdev);
+ if (vf_netdev && netif_running(vf_netdev) &&
+- !netpoll_tx_running(net))
++ netif_carrier_ok(vf_netdev) && !netpoll_tx_running(net))
+ return netvsc_vf_xmit(net, vf_netdev, skb);
+
+ /* We will atmost need two pages to describe the rndis
+--
+2.25.1
+
--- /dev/null
+From 48ecaa98a78bc071d90a650cc0aac8faa06ae53f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 14:19:53 +0000
+Subject: iavf: fix error return code in iavf_init_get_resources()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 753f3884f253de6b6d3a516e6651bda0baf4aede ]
+
+Fix to return negative error code -ENOMEM from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: b66c7bc1cd4d ("iavf: Refactor init state machine")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index fa82768e5eda9..bc83e2d999442 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -1863,8 +1863,10 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter)
+
+ adapter->rss_key = kzalloc(adapter->rss_key_size, GFP_KERNEL);
+ adapter->rss_lut = kzalloc(adapter->rss_lut_size, GFP_KERNEL);
+- if (!adapter->rss_key || !adapter->rss_lut)
++ if (!adapter->rss_key || !adapter->rss_lut) {
++ err = -ENOMEM;
+ goto err_mem;
++ }
+ if (RSS_AQ(adapter))
+ adapter->aq_required |= IAVF_FLAG_AQ_CONFIGURE_RSS;
+ else
+--
+2.25.1
+
--- /dev/null
+From 2891082fced99a4f3a009869466862e60fd7250e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 09:04:22 -0700
+Subject: iavf: Fix updating statistics
+
+From: Tony Nguyen <anthony.l.nguyen@intel.com>
+
+[ Upstream commit 9358076642f14cec8c414850d5a909cafca3a9d6 ]
+
+Commit bac8486116b0 ("iavf: Refactor the watchdog state machine") inverted
+the logic for when to update statistics. Statistics should be updated when
+no other commands are pending, instead they were only requested when a
+command was processed. iavf_request_stats() would see a pending request
+and not request statistics to be updated. This caused statistics to never
+be updated; fix the logic.
+
+Fixes: bac8486116b0 ("iavf: Refactor the watchdog state machine")
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index bc83e2d999442..d338efe5f3f55 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -1948,7 +1948,10 @@ static void iavf_watchdog_task(struct work_struct *work)
+ iavf_send_api_ver(adapter);
+ }
+ } else {
+- if (!iavf_process_aq_command(adapter) &&
++ /* An error will be returned if no commands were
++ * processed; use this opportunity to update stats
++ */
++ if (iavf_process_aq_command(adapter) &&
+ adapter->state == __IAVF_RUNNING)
+ iavf_request_stats(adapter);
+ }
+--
+2.25.1
+
--- /dev/null
+From 9be946549f0485feb590dccfd8febcca0aae7789 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 17:19:15 -0700
+Subject: ice: Clear and free XLT entries on reset
+
+From: Vignesh Sridhar <vignesh.sridhar@intel.com>
+
+[ Upstream commit ec1d1d2302067e3ccbc4d0adcd36d72410933b70 ]
+
+This fix has been added to address memory leak issues resulting from
+triggering a sudden driver reset which does not allow us to follow our
+normal removal flows for SW XLT entries for advanced features.
+
+- Adding call to destroy flow profile locks when clearing SW XLT tables.
+
+- Extraction sequence entries were not correctly cleared previously
+which could cause ownership conflicts for repeated reset-replay calls.
+
+Fixes: 31ad4e4ee1e4 ("ice: Allocate flow profile")
+Signed-off-by: Vignesh Sridhar <vignesh.sridhar@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+index 4420fc02f7e7a..6698612048625 100644
+--- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
++++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+@@ -2922,6 +2922,8 @@ static void ice_free_flow_profs(struct ice_hw *hw, u8 blk_idx)
+ ICE_FLOW_ENTRY_HNDL(e));
+
+ list_del(&p->l_entry);
++
++ mutex_destroy(&p->entries_lock);
+ devm_kfree(ice_hw_to_dev(hw), p);
+ }
+ mutex_unlock(&hw->fl_profs_locks[blk_idx]);
+@@ -3039,7 +3041,7 @@ void ice_clear_hw_tbls(struct ice_hw *hw)
+ memset(prof_redir->t, 0,
+ prof_redir->count * sizeof(*prof_redir->t));
+
+- memset(es->t, 0, es->count * sizeof(*es->t));
++ memset(es->t, 0, es->count * sizeof(*es->t) * es->fvw);
+ memset(es->ref_count, 0, es->count * sizeof(*es->ref_count));
+ memset(es->written, 0, es->count * sizeof(*es->written));
+ }
+--
+2.25.1
+
--- /dev/null
+From 0ddaa3ca9b714838ba72fbd5c675487fa66edb51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 17:19:18 -0700
+Subject: ice: Graceful error handling in HW table calloc failure
+
+From: Surabhi Boob <surabhi.boob@intel.com>
+
+[ Upstream commit bcc46cb8a077c6189b44f1555b8659837f748eb2 ]
+
+In the ice_init_hw_tbls, if the devm_kcalloc for es->written fails, catch
+that error and bail out gracefully, instead of continuing with a NULL
+pointer.
+
+Fixes: 32d63fa1e9f3 ("ice: Initialize DDP package structures")
+Signed-off-by: Surabhi Boob <surabhi.boob@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+index 6698612048625..504a02b071cee 100644
+--- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
++++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+@@ -3152,10 +3152,12 @@ enum ice_status ice_init_hw_tbls(struct ice_hw *hw)
+ es->ref_count = devm_kcalloc(ice_hw_to_dev(hw), es->count,
+ sizeof(*es->ref_count),
+ GFP_KERNEL);
++ if (!es->ref_count)
++ goto err;
+
+ es->written = devm_kcalloc(ice_hw_to_dev(hw), es->count,
+ sizeof(*es->written), GFP_KERNEL);
+- if (!es->ref_count)
++ if (!es->written)
+ goto err;
+ }
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From da039afbf7cf4374050985be2cd1098c916eae4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 17:26:10 +0800
+Subject: iio: amplifiers: ad8366: Change devm_gpiod_get() to optional and add
+ the missed check
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 9ca39411f9a9c833727750431da8dfd96ff80005 ]
+
+Since if there is no GPIO, nothing happens, replace devm_gpiod_get()
+with devm_gpiod_get_optional().
+Also add IS_ERR() to fix the missing-check warning.
+
+Fixes: cee211f4e5a0 ("iio: amplifiers: ad8366: Add support for the ADA4961 DGA")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/amplifiers/ad8366.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/amplifiers/ad8366.c b/drivers/iio/amplifiers/ad8366.c
+index 62167b87caea8..8345ba65d41d8 100644
+--- a/drivers/iio/amplifiers/ad8366.c
++++ b/drivers/iio/amplifiers/ad8366.c
+@@ -262,8 +262,11 @@ static int ad8366_probe(struct spi_device *spi)
+ case ID_ADA4961:
+ case ID_ADL5240:
+ case ID_HMC1119:
+- st->reset_gpio = devm_gpiod_get(&spi->dev, "reset",
+- GPIOD_OUT_HIGH);
++ st->reset_gpio = devm_gpiod_get_optional(&spi->dev, "reset", GPIOD_OUT_HIGH);
++ if (IS_ERR(st->reset_gpio)) {
++ ret = PTR_ERR(st->reset_gpio);
++ goto error_disable_reg;
++ }
+ indio_dev->channels = ada4961_channels;
+ indio_dev->num_channels = ARRAY_SIZE(ada4961_channels);
+ break;
+--
+2.25.1
+
--- /dev/null
+From 7572305a285f7c8af967bb0836c1f053e44c2e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 18:15:52 +0200
+Subject: iio: improve IIO_CONCENTRATION channel type description
+
+From: Tomasz Duszynski <tomasz.duszynski@octakon.com>
+
+[ Upstream commit df16c33a4028159d1ba8a7061c9fa950b58d1a61 ]
+
+IIO_CONCENTRATION together with INFO_RAW specifier is used for reporting
+raw concentrations of pollutants. Raw value should be meaningless
+before being properly scaled. Because of that description shouldn't
+mention raw value unit whatsoever.
+
+Fix this by rephrasing existing description so it follows conventions
+used throughout IIO ABI docs.
+
+Fixes: 8ff6b3bc94930 ("iio: chemical: Add IIO_CONCENTRATION channel type")
+Signed-off-by: Tomasz Duszynski <tomasz.duszynski@octakon.com>
+Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-bus-iio | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
+index d3e53a6d8331b..5c62bfb0f3f57 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -1569,7 +1569,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw
+ KernelVersion: 4.3
+ Contact: linux-iio@vger.kernel.org
+ Description:
+- Raw (unscaled no offset etc.) percentage reading of a substance.
++ Raw (unscaled no offset etc.) reading of a substance. Units
++ after application of scale and offset are percents.
+
+ What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw
+ What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw
+--
+2.25.1
+
--- /dev/null
+From dd5dee7522a55cadf7a3566519d6ca937fa2918a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 01:19:03 -0500
+Subject: ima: Fail rule parsing when buffer hook functions have an invalid
+ action
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit 712183437ebebc89cd086ef96cf9a521fd97fd09 ]
+
+Buffer based hook functions, such as KEXEC_CMDLINE and KEY_CHECK, can
+only measure. The process_buffer_measurement() function quietly ignores
+all actions except measure so make this behavior clear at the time of
+policy load.
+
+The parsing of the keyrings conditional had a check to ensure that it
+was only specified with measure actions but the check should be on the
+hook function and not the keyrings conditional since
+"appraise func=KEY_CHECK" is not a valid rule.
+
+Fixes: b0935123a183 ("IMA: Define a new hook to measure the kexec boot command line arguments")
+Fixes: 5808611cccb2 ("IMA: Add KEY_CHECK func to measure keys")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_policy.c | 40 +++++++++++++++++++++++++++--
+ 1 file changed, 38 insertions(+), 2 deletions(-)
+
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 18271920d315d..a3d72342408ad 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -973,6 +973,43 @@ static void check_template_modsig(const struct ima_template_desc *template)
+ #undef MSG
+ }
+
++static bool ima_validate_rule(struct ima_rule_entry *entry)
++{
++ /* Ensure that the action is set */
++ if (entry->action == UNKNOWN)
++ return false;
++
++ /*
++ * Ensure that the hook function is compatible with the other
++ * components of the rule
++ */
++ switch (entry->func) {
++ case NONE:
++ case FILE_CHECK:
++ case MMAP_CHECK:
++ case BPRM_CHECK:
++ case CREDS_CHECK:
++ case POST_SETATTR:
++ case MODULE_CHECK:
++ case FIRMWARE_CHECK:
++ case KEXEC_KERNEL_CHECK:
++ case KEXEC_INITRAMFS_CHECK:
++ case POLICY_CHECK:
++ /* Validation of these hook functions is in ima_parse_rule() */
++ break;
++ case KEXEC_CMDLINE:
++ case KEY_CHECK:
++ if (entry->action & ~(MEASURE | DONT_MEASURE))
++ return false;
++
++ break;
++ default:
++ return false;
++ }
++
++ return true;
++}
++
+ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ {
+ struct audit_buffer *ab;
+@@ -1150,7 +1187,6 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ keyrings_len = strlen(args[0].from) + 1;
+
+ if ((entry->keyrings) ||
+- (entry->action != MEASURE) ||
+ (entry->func != KEY_CHECK) ||
+ (keyrings_len < 2)) {
+ result = -EINVAL;
+@@ -1356,7 +1392,7 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ break;
+ }
+ }
+- if (!result && (entry->action == UNKNOWN))
++ if (!result && !ima_validate_rule(entry))
+ result = -EINVAL;
+ else if (entry->action == APPRAISE)
+ temp_ima_appraise |= ima_appraise_flag(entry->func);
+--
+2.25.1
+
--- /dev/null
+From 80881757fc875519276b1630ae4977852dc1f026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 01:19:04 -0500
+Subject: ima: Fail rule parsing when the KEXEC_CMDLINE hook is combined with
+ an invalid cond
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit db2045f5892a9db7354442bf77f9b03b50ff9ee1 ]
+
+The KEXEC_CMDLINE hook function only supports the pcr conditional. Make
+this clear at policy load so that IMA policy authors don't assume that
+other conditionals are supported.
+
+Since KEXEC_CMDLINE's inception, ima_match_rules() has always returned
+true on any loaded KEXEC_CMDLINE rule without any consideration for
+other conditionals present in the rule. Make it clear that pcr is the
+only supported KEXEC_CMDLINE conditional by returning an error during
+policy load.
+
+An example of why this is a problem can be explained with the following
+rule:
+
+ dont_measure func=KEXEC_CMDLINE obj_type=foo_t
+
+An IMA policy author would have assumed that rule is valid because the
+parser accepted it but the result was that measurements for all
+KEXEC_CMDLINE operations would be disabled.
+
+Fixes: b0935123a183 ("IMA: Define a new hook to measure the kexec boot command line arguments")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
+Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_policy.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index a3d72342408ad..a77e0b34e72f7 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -343,6 +343,17 @@ static int ima_lsm_update_rule(struct ima_rule_entry *entry)
+ return 0;
+ }
+
++static bool ima_rule_contains_lsm_cond(struct ima_rule_entry *entry)
++{
++ int i;
++
++ for (i = 0; i < MAX_LSM_RULES; i++)
++ if (entry->lsm[i].args_p)
++ return true;
++
++ return false;
++}
++
+ /*
+ * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
+ * to the old, stale LSM policy. Update the IMA LSM based rules to reflect
+@@ -998,6 +1009,16 @@ static bool ima_validate_rule(struct ima_rule_entry *entry)
+ /* Validation of these hook functions is in ima_parse_rule() */
+ break;
+ case KEXEC_CMDLINE:
++ if (entry->action & ~(MEASURE | DONT_MEASURE))
++ return false;
++
++ if (entry->flags & ~(IMA_FUNC | IMA_PCR))
++ return false;
++
++ if (ima_rule_contains_lsm_cond(entry))
++ return false;
++
++ break;
+ case KEY_CHECK:
+ if (entry->action & ~(MEASURE | DONT_MEASURE))
+ return false;
+--
+2.25.1
+
--- /dev/null
+From d6ccc86d5bebc9a317fe213597a6dafbe526d0d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 01:19:05 -0500
+Subject: ima: Fail rule parsing when the KEY_CHECK hook is combined with an
+ invalid cond
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit eb624fe214a2e156ddafd9868377cf91499f789d ]
+
+The KEY_CHECK function only supports the uid, pcr, and keyrings
+conditionals. Make this clear at policy load so that IMA policy authors
+don't assume that other conditionals are supported.
+
+Fixes: 5808611cccb2 ("IMA: Add KEY_CHECK func to measure keys")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_policy.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index a77e0b34e72f7..3e3e568c81309 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -1023,6 +1023,13 @@ static bool ima_validate_rule(struct ima_rule_entry *entry)
+ if (entry->action & ~(MEASURE | DONT_MEASURE))
+ return false;
+
++ if (entry->flags & ~(IMA_FUNC | IMA_UID | IMA_PCR |
++ IMA_KEYRINGS))
++ return false;
++
++ if (ima_rule_contains_lsm_cond(entry))
++ return false;
++
+ break;
+ default:
+ return false;
+--
+2.25.1
+
--- /dev/null
+From cfa57d4776e0b71e17b115e7647d677358d995d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 01:19:02 -0500
+Subject: ima: Free the entire rule if it fails to parse
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit 2bdd737c5687d6dec30e205953146ede8a87dbdd ]
+
+Use ima_free_rule() to fix memory leaks of allocated ima_rule_entry
+members, such as .fsname and .keyrings, when an error is encountered
+during rule parsing.
+
+Set the args_p pointer to NULL after freeing it in the error path of
+ima_lsm_rule_init() so that it isn't freed twice.
+
+This fixes a memory leak seen when loading an rule that contains an
+additional piece of allocated memory, such as an fsname, followed by an
+invalid conditional:
+
+ # echo "measure fsname=tmpfs bad=cond" > /sys/kernel/security/ima/policy
+ -bash: echo: write error: Invalid argument
+ # echo scan > /sys/kernel/debug/kmemleak
+ # cat /sys/kernel/debug/kmemleak
+ unreferenced object 0xffff98e7e4ece6c0 (size 8):
+ comm "bash", pid 672, jiffies 4294791843 (age 21.855s)
+ hex dump (first 8 bytes):
+ 74 6d 70 66 73 00 6b a5 tmpfs.k.
+ backtrace:
+ [<00000000abab7413>] kstrdup+0x2e/0x60
+ [<00000000f11ede32>] ima_parse_add_rule+0x7d4/0x1020
+ [<00000000f883dd7a>] ima_write_policy+0xab/0x1d0
+ [<00000000b17cf753>] vfs_write+0xde/0x1d0
+ [<00000000b8ddfdea>] ksys_write+0x68/0xe0
+ [<00000000b8e21e87>] do_syscall_64+0x56/0xa0
+ [<0000000089ea7b98>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: f1b08bbcbdaf ("ima: define a new policy condition based on the filesystem name")
+Fixes: 2b60c0ecedf8 ("IMA: Read keyrings= option from the IMA policy")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_policy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 641582230861c..18271920d315d 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -913,6 +913,7 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry,
+
+ if (ima_rules == &ima_default_rules) {
+ kfree(entry->lsm[lsm_rule].args_p);
++ entry->lsm[lsm_rule].args_p = NULL;
+ result = -EINVAL;
+ } else
+ result = 0;
+@@ -1404,7 +1405,7 @@ ssize_t ima_parse_add_rule(char *rule)
+
+ result = ima_parse_rule(p, entry);
+ if (result) {
+- kfree(entry);
++ ima_free_rule(entry);
+ integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
+ NULL, op, "invalid-policy", result,
+ audit_info);
+--
+2.25.1
+
--- /dev/null
+From 4972e15553d04fc31599483b3868092f568eb67b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 01:19:01 -0500
+Subject: ima: Free the entire rule when deleting a list of rules
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit 465aee77aae857b5fcde56ee192b33dc369fba04 ]
+
+Create a function, ima_free_rule(), to free all memory associated with
+an ima_rule_entry. Use the new function to fix memory leaks of allocated
+ima_rule_entry members, such as .fsname and .keyrings, when deleting a
+list of rules.
+
+Make the existing ima_lsm_free_rule() function specific to the LSM
+audit rule array of an ima_rule_entry and require that callers make an
+additional call to kfree to free the ima_rule_entry itself.
+
+This fixes a memory leak seen when loading by a valid rule that contains
+an additional piece of allocated memory, such as an fsname, followed by
+an invalid rule that triggers a policy load failure:
+
+ # echo -e "dont_measure fsname=securityfs\nbad syntax" > \
+ /sys/kernel/security/ima/policy
+ -bash: echo: write error: Invalid argument
+ # echo scan > /sys/kernel/debug/kmemleak
+ # cat /sys/kernel/debug/kmemleak
+ unreferenced object 0xffff9bab67ca12c0 (size 16):
+ comm "bash", pid 684, jiffies 4295212803 (age 252.344s)
+ hex dump (first 16 bytes):
+ 73 65 63 75 72 69 74 79 66 73 00 6b 6b 6b 6b a5 securityfs.kkkk.
+ backtrace:
+ [<00000000adc80b1b>] kstrdup+0x2e/0x60
+ [<00000000d504cb0d>] ima_parse_add_rule+0x7d4/0x1020
+ [<00000000444825ac>] ima_write_policy+0xab/0x1d0
+ [<000000002b7f0d6c>] vfs_write+0xde/0x1d0
+ [<0000000096feedcf>] ksys_write+0x68/0xe0
+ [<0000000052b544a2>] do_syscall_64+0x56/0xa0
+ [<000000007ead1ba7>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: f1b08bbcbdaf ("ima: define a new policy condition based on the filesystem name")
+Fixes: 2b60c0ecedf8 ("IMA: Read keyrings= option from the IMA policy")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_policy.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 236a731492d1e..641582230861c 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -261,6 +261,21 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry)
+ security_filter_rule_free(entry->lsm[i].rule);
+ kfree(entry->lsm[i].args_p);
+ }
++}
++
++static void ima_free_rule(struct ima_rule_entry *entry)
++{
++ if (!entry)
++ return;
++
++ /*
++ * entry->template->fields may be allocated in ima_parse_rule() but that
++ * reference is owned by the corresponding ima_template_desc element in
++ * the defined_templates list and cannot be freed here
++ */
++ kfree(entry->fsname);
++ kfree(entry->keyrings);
++ ima_lsm_free_rule(entry);
+ kfree(entry);
+ }
+
+@@ -302,6 +317,7 @@ static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry)
+
+ out_err:
+ ima_lsm_free_rule(nentry);
++ kfree(nentry);
+ return NULL;
+ }
+
+@@ -315,7 +331,14 @@ static int ima_lsm_update_rule(struct ima_rule_entry *entry)
+
+ list_replace_rcu(&entry->list, &nentry->list);
+ synchronize_rcu();
++ /*
++ * ima_lsm_copy_rule() shallow copied all references, except for the
++ * LSM references, from entry to nentry so we only want to free the LSM
++ * references and the entry itself. All other memory refrences will now
++ * be owned by nentry.
++ */
+ ima_lsm_free_rule(entry);
++ kfree(entry);
+
+ return 0;
+ }
+@@ -1402,15 +1425,11 @@ ssize_t ima_parse_add_rule(char *rule)
+ void ima_delete_rules(void)
+ {
+ struct ima_rule_entry *entry, *tmp;
+- int i;
+
+ temp_ima_appraise = 0;
+ list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
+- for (i = 0; i < MAX_LSM_RULES; i++)
+- kfree(entry->lsm[i].args_p);
+-
+ list_del(&entry->list);
+- kfree(entry);
++ ima_free_rule(entry);
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From b5aef14b76b505fd8a002b97a0630ce155eb2c69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 01:19:00 -0500
+Subject: ima: Have the LSM free its audit rule
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit 9ff8a616dfab96a4fa0ddd36190907dc68886d9b ]
+
+Ask the LSM to free its audit rule rather than directly calling kfree().
+Both AppArmor and SELinux do additional work in their audit_rule_free()
+hooks. Fix memory leaks by allowing the LSMs to perform necessary work.
+
+Fixes: b16942455193 ("ima: use the lsm policy update notifier")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Cc: Janne Karhunen <janne.karhunen@gmail.com>
+Cc: Casey Schaufler <casey@schaufler-ca.com>
+Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima.h | 5 +++++
+ security/integrity/ima/ima_policy.c | 2 +-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
+index 9d94080bdad82..f0748f8ca47e9 100644
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -404,6 +404,7 @@ static inline void ima_free_modsig(struct modsig *modsig)
+ #ifdef CONFIG_IMA_LSM_RULES
+
+ #define security_filter_rule_init security_audit_rule_init
++#define security_filter_rule_free security_audit_rule_free
+ #define security_filter_rule_match security_audit_rule_match
+
+ #else
+@@ -414,6 +415,10 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,
+ return -EINVAL;
+ }
+
++static inline void security_filter_rule_free(void *lsmrule)
++{
++}
++
+ static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
+ void *lsmrule)
+ {
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index e493063a3c344..236a731492d1e 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -258,7 +258,7 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry)
+ int i;
+
+ for (i = 0; i < MAX_LSM_RULES; i++) {
+- kfree(entry->lsm[i].rule);
++ security_filter_rule_free(entry->lsm[i].rule);
+ kfree(entry->lsm[i].args_p);
+ }
+ kfree(entry);
+--
+2.25.1
+
--- /dev/null
+From 3114761c0bc5d7c6b1ee7f6af3b78eb89793e72c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 18:43:47 +0300
+Subject: io_uring: fix racy overflow count reporting
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit b2bd1cf99f3e7c8fbf12ea07af2c6998e1209e25 ]
+
+All ->cq_overflow modifications should be under completion_lock,
+otherwise it can report a wrong number to the userspace. Fix it in
+io_uring_cancel_files().
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index d732566955d37..1d8761a9f3b88 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -7536,10 +7536,9 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx,
+ clear_bit(0, &ctx->cq_check_overflow);
+ ctx->rings->sq_flags &= ~IORING_SQ_CQ_OVERFLOW;
+ }
+- spin_unlock_irq(&ctx->completion_lock);
+-
+ WRITE_ONCE(ctx->rings->cq_overflow,
+ atomic_inc_return(&ctx->cached_cq_overflow));
++ spin_unlock_irq(&ctx->completion_lock);
+
+ /*
+ * Put inflight ref and overflow ref. If that's
+--
+2.25.1
+
--- /dev/null
+From b20eb882c221914a794ba084ae2eb0ea562e15ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Jun 2020 14:04:59 +0300
+Subject: io_uring: fix req->work corruption
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 8ef77766ba8694968ed4ba24311b4bacee14f235 ]
+
+req->work and req->task_work are in a union, so io_req_task_queue() screws
+everything that was in work. De-union them for now.
+
+[ 704.367253] BUG: unable to handle page fault for address:
+ ffffffffaf7330d0
+[ 704.367256] #PF: supervisor write access in kernel mode
+[ 704.367256] #PF: error_code(0x0003) - permissions violation
+[ 704.367261] CPU: 6 PID: 1654 Comm: io_wqe_worker-0 Tainted: G
+I 5.8.0-rc2-00038-ge28d0bdc4863-dirty #498
+[ 704.367265] RIP: 0010:_raw_spin_lock+0x1e/0x36
+...
+[ 704.367276] __alloc_fd+0x35/0x150
+[ 704.367279] __get_unused_fd_flags+0x25/0x30
+[ 704.367280] io_openat2+0xcb/0x1b0
+[ 704.367283] io_issue_sqe+0x36a/0x1320
+[ 704.367294] io_wq_submit_work+0x58/0x160
+[ 704.367295] io_worker_handle_work+0x2a3/0x430
+[ 704.367296] io_wqe_worker+0x2a0/0x350
+[ 704.367301] kthread+0x136/0x180
+[ 704.367304] ret_from_fork+0x22/0x30
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 8503aec7ea295..d732566955d37 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -669,12 +669,12 @@ struct io_kiocb {
+ * restore the work, if needed.
+ */
+ struct {
+- struct callback_head task_work;
+ struct hlist_node hash_node;
+ struct async_poll *apoll;
+ };
+ struct io_wq_work work;
+ };
++ struct callback_head task_work;
+ };
+
+ #define IO_PLUG_THRESHOLD 2
+--
+2.25.1
+
--- /dev/null
+From b3abbee1a833b0082fe9d1673f57b73d1c4a4d99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 11:31:11 +0200
+Subject: io_uring: fix sq array offset calculation
+
+From: Dmitry Vyukov <dvyukov@google.com>
+
+[ Upstream commit b36200f543ff07a1cb346aa582349141df2c8068 ]
+
+rings_size() sets sq_offset to the total size of the rings (the returned
+value which is used for memory allocation). This is wrong: sq array should
+be located within the rings, not after them. Set sq_offset to where it
+should be.
+
+Fixes: 75b28affdd6a ("io_uring: allocate the two rings together")
+Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
+Acked-by: Hristo Venev <hristo@venev.name>
+Cc: io-uring@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 95bacab047ddb..8503aec7ea295 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -7093,6 +7093,9 @@ static unsigned long rings_size(unsigned sq_entries, unsigned cq_entries,
+ return SIZE_MAX;
+ #endif
+
++ if (sq_offset)
++ *sq_offset = off;
++
+ sq_array_size = array_size(sizeof(u32), sq_entries);
+ if (sq_array_size == SIZE_MAX)
+ return SIZE_MAX;
+@@ -7100,9 +7103,6 @@ static unsigned long rings_size(unsigned sq_entries, unsigned cq_entries,
+ if (check_add_overflow(off, sq_array_size, &off))
+ return SIZE_MAX;
+
+- if (sq_offset)
+- *sq_offset = off;
+-
+ return off;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 661246f91e66ead6b209f2f46ed3d474f3e49cf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 18:43:48 +0300
+Subject: io_uring: fix stalled deferred requests
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit dd9dfcdf5a603680458f5e7b0d2273c66e5417db ]
+
+Always do io_commit_cqring() after completing a request, even if it was
+accounted as overflowed on the CQ side. Failing to do that may lead to
+not to pushing deferred requests when needed, and so stalling the whole
+ring.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 1d8761a9f3b88..1619ca74b44d9 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -7538,6 +7538,7 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx,
+ }
+ WRITE_ONCE(ctx->rings->cq_overflow,
+ atomic_inc_return(&ctx->cached_cq_overflow));
++ io_commit_cqring(ctx);
+ spin_unlock_irq(&ctx->completion_lock);
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From e596bec6a0137b8666574d751db9b34b2d2a6275 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 17:03:21 +0800
+Subject: iocost: Fix check condition of iocg abs_vdebt
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+[ Upstream commit d9012a59db54442d5b2fcfdfcded35cf566397d3 ]
+
+We shouldn't skip iocg when its abs_vdebt is not zero.
+
+Fixes: 0b80f9866e6b ("iocost: protect iocg->abs_vdebt with iocg->waitq.lock")
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-iocost.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-iocost.c b/block/blk-iocost.c
+index 8ac4aad66ebc3..86ba6fd254e1d 100644
+--- a/block/blk-iocost.c
++++ b/block/blk-iocost.c
+@@ -1370,7 +1370,7 @@ static void ioc_timer_fn(struct timer_list *timer)
+ * should have woken up in the last period and expire idle iocgs.
+ */
+ list_for_each_entry_safe(iocg, tiocg, &ioc->active_iocgs, active_list) {
+- if (!waitqueue_active(&iocg->waitq) && iocg->abs_vdebt &&
++ if (!waitqueue_active(&iocg->waitq) && !iocg->abs_vdebt &&
+ !iocg_is_idle(iocg))
+ continue;
+
+--
+2.25.1
+
--- /dev/null
+From 84d980663ad10457f4859ae6ebf8628a7f3fb12a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 10:49:27 -0700
+Subject: iomap: Make sure iomap_end is called after iomap_begin
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 856473cd5d17dbbf3055710857c67a4af6d9fcc0 ]
+
+Make sure iomap_end is always called when iomap_begin succeeds.
+
+Without this fix, iomap_end won't be called when a filesystem's
+iomap_begin operation returns an invalid mapping, bypassing any
+unlocking done in iomap_end. With this fix, the unlocking will still
+happen.
+
+This bug was found by Bob Peterson during code review. It's unlikely
+that such iomap_begin bugs will survive to affect users, so backporting
+this fix seems unnecessary.
+
+Fixes: ae259a9c8593 ("fs: introduce iomap infrastructure")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap/apply.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/fs/iomap/apply.c b/fs/iomap/apply.c
+index 76925b40b5fd2..26ab6563181fc 100644
+--- a/fs/iomap/apply.c
++++ b/fs/iomap/apply.c
+@@ -46,10 +46,14 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags,
+ ret = ops->iomap_begin(inode, pos, length, flags, &iomap, &srcmap);
+ if (ret)
+ return ret;
+- if (WARN_ON(iomap.offset > pos))
+- return -EIO;
+- if (WARN_ON(iomap.length == 0))
+- return -EIO;
++ if (WARN_ON(iomap.offset > pos)) {
++ written = -EIO;
++ goto out;
++ }
++ if (WARN_ON(iomap.length == 0)) {
++ written = -EIO;
++ goto out;
++ }
+
+ trace_iomap_apply_dstmap(inode, &iomap);
+ if (srcmap.type != IOMAP_HOLE)
+@@ -80,6 +84,7 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags,
+ written = actor(inode, pos, length, data, &iomap,
+ srcmap.type != IOMAP_HOLE ? &srcmap : &iomap);
+
++out:
+ /*
+ * Now the data has been copied, commit the range we've copied. This
+ * should not fail unless the filesystem has had a fatal error.
+--
+2.25.1
+
--- /dev/null
+From 7edbd91a2b33f8afbb22b80a1c66572754335ffa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 13:34:08 -0700
+Subject: ionic: rearrange reset and bus-master control
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 6a6014e2fb276753d4dc9b803370e7af7f57e30b ]
+
+We can prevent potential incorrect DMA access attempts from the
+NIC by enabling bus-master after the reset, and by disabling
+bus-master earlier in cleanup.
+
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+index 2924cde440aa8..85c686c16741f 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+@@ -247,12 +247,11 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ goto err_out_pci_disable_device;
+ }
+
+- pci_set_master(pdev);
+ pcie_print_link_status(pdev);
+
+ err = ionic_map_bars(ionic);
+ if (err)
+- goto err_out_pci_clear_master;
++ goto err_out_pci_disable_device;
+
+ /* Configure the device */
+ err = ionic_setup(ionic);
+@@ -260,6 +259,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ dev_err(dev, "Cannot setup device: %d, aborting\n", err);
+ goto err_out_unmap_bars;
+ }
++ pci_set_master(pdev);
+
+ err = ionic_identify(ionic);
+ if (err) {
+@@ -350,6 +350,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ ionic_reset(ionic);
+ err_out_teardown:
+ ionic_dev_teardown(ionic);
++ pci_clear_master(pdev);
+ /* Don't fail the probe for these errors, keep
+ * the hw interface around for inspection
+ */
+@@ -358,8 +359,6 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ err_out_unmap_bars:
+ ionic_unmap_bars(ionic);
+ pci_release_regions(pdev);
+-err_out_pci_clear_master:
+- pci_clear_master(pdev);
+ err_out_pci_disable_device:
+ pci_disable_device(pdev);
+ err_out_debugfs_del_dev:
+@@ -389,9 +388,9 @@ static void ionic_remove(struct pci_dev *pdev)
+ ionic_port_reset(ionic);
+ ionic_reset(ionic);
+ ionic_dev_teardown(ionic);
++ pci_clear_master(pdev);
+ ionic_unmap_bars(ionic);
+ pci_release_regions(pdev);
+- pci_clear_master(pdev);
+ pci_disable_device(pdev);
+ ionic_debugfs_del_dev(ionic);
+ mutex_destroy(&ionic->dev_cmd_lock);
+--
+2.25.1
+
--- /dev/null
+From eb5d3766d6686c0e35d8e4c1fc32a08ad2c91f71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 13:34:07 -0700
+Subject: ionic: update eid test for overflow
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 3fbc9bb6ca32d12d4d32a7ae32abef67ac95f889 ]
+
+Fix up our comparison to better handle a potential (but largely
+unlikely) wrap around.
+
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index e55d41546cff2..aa93f9a6252df 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -723,7 +723,7 @@ static bool ionic_notifyq_service(struct ionic_cq *cq,
+ eid = le64_to_cpu(comp->event.eid);
+
+ /* Have we run out of new completions to process? */
+- if (eid <= lif->last_eid)
++ if ((s64)(eid - lif->last_eid) <= 0)
+ return false;
+
+ lif->last_eid = eid;
+--
+2.25.1
+
--- /dev/null
+From 616492553fc8dc9ab1afb64c5de6cdc94bac7d97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 18:17:19 +0300
+Subject: ipvs: allow connection reuse for unconfirmed conntrack
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit f0a5e4d7a594e0fe237d3dfafb069bb82f80f42f ]
+
+YangYuxi is reporting that connection reuse
+is causing one-second delay when SYN hits
+existing connection in TIME_WAIT state.
+Such delay was added to give time to expire
+both the IPVS connection and the corresponding
+conntrack. This was considered a rare case
+at that time but it is causing problem for
+some environments such as Kubernetes.
+
+As nf_conntrack_tcp_packet() can decide to
+release the conntrack in TIME_WAIT state and
+to replace it with a fresh NEW conntrack, we
+can use this to allow rescheduling just by
+tuning our check: if the conntrack is
+confirmed we can not schedule it to different
+real server and the one-second delay still
+applies but if new conntrack was created,
+we are free to select new real server without
+any delays.
+
+YangYuxi lists some of the problem reports:
+
+- One second connection delay in masquerading mode:
+https://marc.info/?t=151683118100004&r=1&w=2
+
+- IPVS low throughput #70747
+https://github.com/kubernetes/kubernetes/issues/70747
+
+- Apache Bench can fill up ipvs service proxy in seconds #544
+https://github.com/cloudnativelabs/kube-router/issues/544
+
+- Additional 1s latency in `host -> service IP -> pod`
+https://github.com/kubernetes/kubernetes/issues/90854
+
+Fixes: f719e3754ee2 ("ipvs: drop first packet to redirect conntrack")
+Co-developed-by: YangYuxi <yx.atom1@gmail.com>
+Signed-off-by: YangYuxi <yx.atom1@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Reviewed-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_vs.h | 10 ++++------
+ net/netfilter/ipvs/ip_vs_core.c | 12 +++++++-----
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 83be2d93b4076..fe96aa462d050 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -1624,18 +1624,16 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
+ }
+ #endif /* CONFIG_IP_VS_NFCT */
+
+-/* Really using conntrack? */
+-static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp,
+- struct sk_buff *skb)
++/* Using old conntrack that can not be redirected to another real server? */
++static inline bool ip_vs_conn_uses_old_conntrack(struct ip_vs_conn *cp,
++ struct sk_buff *skb)
+ {
+ #ifdef CONFIG_IP_VS_NFCT
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *ct;
+
+- if (!(cp->flags & IP_VS_CONN_F_NFCT))
+- return false;
+ ct = nf_ct_get(skb, &ctinfo);
+- if (ct)
++ if (ct && nf_ct_is_confirmed(ct))
+ return true;
+ #endif
+ return false;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index aa6a603a2425b..517f6a2ac15af 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2066,14 +2066,14 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+
+ conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
+ if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) {
+- bool uses_ct = false, resched = false;
++ bool old_ct = false, resched = false;
+
+ if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
+ unlikely(!atomic_read(&cp->dest->weight))) {
+ resched = true;
+- uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+ } else if (is_new_conn_expected(cp, conn_reuse_mode)) {
+- uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+ if (!atomic_read(&cp->n_control)) {
+ resched = true;
+ } else {
+@@ -2081,15 +2081,17 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ * that uses conntrack while it is still
+ * referenced by controlled connection(s).
+ */
+- resched = !uses_ct;
++ resched = !old_ct;
+ }
+ }
+
+ if (resched) {
++ if (!old_ct)
++ cp->flags &= ~IP_VS_CONN_F_NFCT;
+ if (!atomic_read(&cp->n_control))
+ ip_vs_conn_expire_now(cp);
+ __ip_vs_conn_put(cp);
+- if (uses_ct)
++ if (old_ct)
+ return NF_DROP;
+ cp = NULL;
+ }
+--
+2.25.1
+
--- /dev/null
+From 377b0a99761474ce97b9e18a6524f3efcda76a95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 21:37:46 +0800
+Subject: irqchip/gic-v4.1: Use GFP_ATOMIC flag in allocate_vpe_l1_table()
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit d1bd7e0ba533a2a6f313579ec9b504f6614c35c4 ]
+
+Booting the latest kernel with DEBUG_ATOMIC_SLEEP=y on a GICv4.1 enabled
+box, I get the following kernel splat:
+
+[ 0.053766] BUG: sleeping function called from invalid context at mm/slab.h:567
+[ 0.053767] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/1
+[ 0.053769] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.8.0-rc3+ #23
+[ 0.053770] Call trace:
+[ 0.053774] dump_backtrace+0x0/0x218
+[ 0.053775] show_stack+0x2c/0x38
+[ 0.053777] dump_stack+0xc4/0x10c
+[ 0.053779] ___might_sleep+0xfc/0x140
+[ 0.053780] __might_sleep+0x58/0x90
+[ 0.053782] slab_pre_alloc_hook+0x7c/0x90
+[ 0.053783] kmem_cache_alloc_trace+0x60/0x2f0
+[ 0.053785] its_cpu_init+0x6f4/0xe40
+[ 0.053786] gic_starting_cpu+0x24/0x38
+[ 0.053788] cpuhp_invoke_callback+0xa0/0x710
+[ 0.053789] notify_cpu_starting+0xcc/0xd8
+[ 0.053790] secondary_start_kernel+0x148/0x200
+
+ # ./scripts/faddr2line vmlinux its_cpu_init+0x6f4/0xe40
+its_cpu_init+0x6f4/0xe40:
+allocate_vpe_l1_table at drivers/irqchip/irq-gic-v3-its.c:2818
+(inlined by) its_cpu_init_lpis at drivers/irqchip/irq-gic-v3-its.c:3138
+(inlined by) its_cpu_init at drivers/irqchip/irq-gic-v3-its.c:5166
+
+It turned out that we're allocating memory using GFP_KERNEL (may sleep)
+within the CPU hotplug notifier, which is indeed an atomic context. Bad
+thing may happen if we're playing on a system with more than a single
+CommonLPIAff group. Avoid it by turning this into an atomic allocation.
+
+Fixes: 5e5168461c22 ("irqchip/gic-v4.1: VPE table (aka GICR_VPROPBASER) allocation")
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20200630133746.816-1-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index beac4caefad9a..da44bfa48bc25 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2814,7 +2814,7 @@ static int allocate_vpe_l1_table(void)
+ if (val & GICR_VPROPBASER_4_1_VALID)
+ goto out;
+
+- gic_data_rdist()->vpe_table_mask = kzalloc(sizeof(cpumask_t), GFP_KERNEL);
++ gic_data_rdist()->vpe_table_mask = kzalloc(sizeof(cpumask_t), GFP_ATOMIC);
+ if (!gic_data_rdist()->vpe_table_mask)
+ return -ENOMEM;
+
+@@ -2881,7 +2881,7 @@ static int allocate_vpe_l1_table(void)
+
+ pr_debug("np = %d, npg = %lld, psz = %d, epp = %d, esz = %d\n",
+ np, npg, psz, epp, esz);
+- page = alloc_pages(GFP_KERNEL | __GFP_ZERO, get_order(np * PAGE_SIZE));
++ page = alloc_pages(GFP_ATOMIC | __GFP_ZERO, get_order(np * PAGE_SIZE));
+ if (!page)
+ return -ENOMEM;
+
+--
+2.25.1
+
--- /dev/null
+From 57617c7c75bd7c614fc7d36d5be18bcc5dbb5773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 11:41:56 -0700
+Subject: irqchip/irq-bcm7038-l1: Guard uses of cpu_logical_map
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 9808357ff2e5bfe1e0dcafef5e78cc5b617a7078 ]
+
+cpu_logical_map is only defined for CONFIG_SMP builds, when we are in an
+UP configuration, the boot CPU is 0.
+
+Fixes: 6468fc18b006 ("irqchip/irq-bcm7038-l1: Add PM support")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20200724184157.29150-1-f.fainelli@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-bcm7038-l1.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
+index fd7c537fb42ac..4127eeab10af1 100644
+--- a/drivers/irqchip/irq-bcm7038-l1.c
++++ b/drivers/irqchip/irq-bcm7038-l1.c
+@@ -327,7 +327,11 @@ static int bcm7038_l1_suspend(void)
+ u32 val;
+
+ /* Wakeup interrupt should only come from the boot cpu */
++#ifdef CONFIG_SMP
+ boot_cpu = cpu_logical_map(0);
++#else
++ boot_cpu = 0;
++#endif
+
+ list_for_each_entry(intc, &bcm7038_l1_intcs_list, list) {
+ for (word = 0; word < intc->n_words; word++) {
+@@ -347,7 +351,11 @@ static void bcm7038_l1_resume(void)
+ struct bcm7038_l1_chip *intc;
+ int boot_cpu, word;
+
++#ifdef CONFIG_SMP
+ boot_cpu = cpu_logical_map(0);
++#else
++ boot_cpu = 0;
++#endif
+
+ list_for_each_entry(intc, &bcm7038_l1_intcs_list, list) {
+ for (word = 0; word < intc->n_words; word++) {
+--
+2.25.1
+
--- /dev/null
+From 93efbceee503c95e67b557d483f3171e550eb3fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 09:44:45 +0200
+Subject: irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit 6eeb997ab5075e770a002c51351fa4ec2c6b5c39 ]
+
+This driver may take a regular spinlock when a raw spinlock
+(irq_desc->lock) is already taken which results in the following
+lockdep splat:
+
+=============================
+[ BUG: Invalid wait context ]
+5.7.0-rc7 #1 Not tainted
+-----------------------------
+swapper/0/0 is trying to lock:
+ffffff800303b798 (&chip_data->lock){....}-{3:3}, at: mtk_sysirq_set_type+0x48/0xc0
+other info that might help us debug this:
+context-{5:5}
+2 locks held by swapper/0/0:
+ #0: ffffff800302ee68 (&desc->request_mutex){....}-{4:4}, at: __setup_irq+0xc4/0x8a0
+ #1: ffffff800302ecf0 (&irq_desc_lock_class){....}-{2:2}, at: __setup_irq+0xe4/0x8a0
+stack backtrace:
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-rc7 #1
+Hardware name: Pumpkin MT8516 (DT)
+Call trace:
+ dump_backtrace+0x0/0x180
+ show_stack+0x14/0x20
+ dump_stack+0xd0/0x118
+ __lock_acquire+0x8c8/0x2270
+ lock_acquire+0xf8/0x470
+ _raw_spin_lock_irqsave+0x50/0x78
+ mtk_sysirq_set_type+0x48/0xc0
+ __irq_set_trigger+0x58/0x170
+ __setup_irq+0x420/0x8a0
+ request_threaded_irq+0xd8/0x190
+ timer_of_init+0x1e8/0x2c4
+ mtk_gpt_init+0x5c/0x1dc
+ timer_probe+0x74/0xf4
+ time_init+0x14/0x44
+ start_kernel+0x394/0x4f0
+
+Replace the spinlock_t with raw_spinlock_t to avoid this warning.
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20200615074445.3579-1-brgl@bgdev.pl
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-mtk-sysirq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-mtk-sysirq.c b/drivers/irqchip/irq-mtk-sysirq.c
+index 73eae5966a403..6ff98b87e5c04 100644
+--- a/drivers/irqchip/irq-mtk-sysirq.c
++++ b/drivers/irqchip/irq-mtk-sysirq.c
+@@ -15,7 +15,7 @@
+ #include <linux/spinlock.h>
+
+ struct mtk_sysirq_chip_data {
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ u32 nr_intpol_bases;
+ void __iomem **intpol_bases;
+ u32 *intpol_words;
+@@ -37,7 +37,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type)
+ reg_index = chip_data->which_word[hwirq];
+ offset = hwirq & 0x1f;
+
+- spin_lock_irqsave(&chip_data->lock, flags);
++ raw_spin_lock_irqsave(&chip_data->lock, flags);
+ value = readl_relaxed(base + reg_index * 4);
+ if (type == IRQ_TYPE_LEVEL_LOW || type == IRQ_TYPE_EDGE_FALLING) {
+ if (type == IRQ_TYPE_LEVEL_LOW)
+@@ -53,7 +53,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type)
+
+ data = data->parent_data;
+ ret = data->chip->irq_set_type(data, type);
+- spin_unlock_irqrestore(&chip_data->lock, flags);
++ raw_spin_unlock_irqrestore(&chip_data->lock, flags);
+ return ret;
+ }
+
+@@ -212,7 +212,7 @@ static int __init mtk_sysirq_of_init(struct device_node *node,
+ ret = -ENOMEM;
+ goto out_free_which_word;
+ }
+- spin_lock_init(&chip_data->lock);
++ raw_spin_lock_init(&chip_data->lock);
+
+ return 0;
+
+--
+2.25.1
+
--- /dev/null
+From fc703a7fc3d4d816aa1d03c35875f0932bef49b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 10:12:48 +0800
+Subject: irqchip/loongson-htvec: Check return value of
+ irq_domain_translate_onecell()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit dbec37048d27cee36e103e113b5f9b1852bfe997 ]
+
+Check the return value of irq_domain_translate_onecell() due to
+it may returns -EINVAL if failed.
+
+Fixes: 818e915fbac5 ("irqchip: Add Loongson HyperTransport Vector support")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/1594087972-21715-5-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-htvec.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-loongson-htvec.c b/drivers/irqchip/irq-loongson-htvec.c
+index b36d403383230..720cf96ae90ee 100644
+--- a/drivers/irqchip/irq-loongson-htvec.c
++++ b/drivers/irqchip/irq-loongson-htvec.c
+@@ -109,11 +109,14 @@ static struct irq_chip htvec_irq_chip = {
+ static int htvec_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ unsigned int nr_irqs, void *arg)
+ {
++ int ret;
+ unsigned long hwirq;
+ unsigned int type, i;
+ struct htvec *priv = domain->host_data;
+
+- irq_domain_translate_onecell(domain, arg, &hwirq, &type);
++ ret = irq_domain_translate_onecell(domain, arg, &hwirq, &type);
++ if (ret)
++ return ret;
+
+ for (i = 0; i < nr_irqs; i++) {
+ irq_domain_set_info(domain, virq + i, hwirq + i, &htvec_irq_chip,
+--
+2.25.1
+
--- /dev/null
+From fed1442a08f515745c470afc9460b23fc94bb339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 10:12:47 +0800
+Subject: irqchip/loongson-htvec: Fix potential resource leak
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 652d54e77a438cf38a5731d8f9983c81e72dc429 ]
+
+In the function htvec_of_init(), system resource "parent_irq"
+was not released in an error case. Thus add a jump target for
+the completion of the desired exception handling.
+
+Fixes: 818e915fbac5 ("irqchip: Add Loongson HyperTransport Vector support")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/1594087972-21715-4-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-htvec.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-loongson-htvec.c b/drivers/irqchip/irq-loongson-htvec.c
+index 1ece9337c78dc..b36d403383230 100644
+--- a/drivers/irqchip/irq-loongson-htvec.c
++++ b/drivers/irqchip/irq-loongson-htvec.c
+@@ -192,7 +192,7 @@ static int htvec_of_init(struct device_node *node,
+ if (!priv->htvec_domain) {
+ pr_err("Failed to create IRQ domain\n");
+ err = -ENOMEM;
+- goto iounmap_base;
++ goto irq_dispose;
+ }
+
+ htvec_reset(priv);
+@@ -203,6 +203,9 @@ static int htvec_of_init(struct device_node *node,
+
+ return 0;
+
++irq_dispose:
++ for (; i > 0; i--)
++ irq_dispose_mapping(parent_irq[i - 1]);
+ iounmap_base:
+ iounmap(priv->base);
+ free_priv:
+--
+2.25.1
+
--- /dev/null
+From 0234817874933373abd81bcfb1b5adb4f6f9f847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 10:12:51 +0800
+Subject: irqchip/loongson-liointc: Fix potential dead lock
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit fa03587cad9bd32aa552377de4f05c50181a35a8 ]
+
+In the function liointc_set_type(), we need to call the function
+irq_gc_unlock_irqrestore() before returning.
+
+Fixes: dbb152267908 ("irqchip: Add driver for Loongson I/O Local Interrupt Controller")
+Reported-by: Jianmin Lv <lvjianmin@loongson.cn>
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/1594087972-21715-8-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-liointc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-loongson-liointc.c b/drivers/irqchip/irq-loongson-liointc.c
+index 63b61474a0cc2..6ef86a334c62d 100644
+--- a/drivers/irqchip/irq-loongson-liointc.c
++++ b/drivers/irqchip/irq-loongson-liointc.c
+@@ -114,6 +114,7 @@ static int liointc_set_type(struct irq_data *data, unsigned int type)
+ liointc_set_bit(gc, LIOINTC_REG_INTC_POL, mask, false);
+ break;
+ default:
++ irq_gc_unlock_irqrestore(gc, flags);
+ return -EINVAL;
+ }
+ irq_gc_unlock_irqrestore(gc, flags);
+--
+2.25.1
+
--- /dev/null
+From 8cbd00e42643d1334bcf0cee28a054bb67306671 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 10:12:49 +0800
+Subject: irqchip/loongson-pch-pic: Check return value of
+ irq_domain_translate_twocell()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 66a535c495f72e1deacc37dfa34acca2a06e3578 ]
+
+Check the return value of irq_domain_translate_twocell() due to
+it may returns -EINVAL if failed and use variable fwspec for it,
+and then use a new variable parent_fwspec which is proper for
+irq_domain_alloc_irqs_parent().
+
+Fixes: ef8c01eb64ca ("irqchip: Add Loongson PCH PIC controller")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/1594087972-21715-6-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-pic.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-pic.c b/drivers/irqchip/irq-loongson-pch-pic.c
+index 2a05b9305012b..016f32c4cbe18 100644
+--- a/drivers/irqchip/irq-loongson-pch-pic.c
++++ b/drivers/irqchip/irq-loongson-pch-pic.c
+@@ -135,16 +135,19 @@ static int pch_pic_alloc(struct irq_domain *domain, unsigned int virq,
+ int err;
+ unsigned int type;
+ unsigned long hwirq;
+- struct irq_fwspec fwspec;
++ struct irq_fwspec *fwspec = arg;
++ struct irq_fwspec parent_fwspec;
+ struct pch_pic *priv = domain->host_data;
+
+- irq_domain_translate_twocell(domain, arg, &hwirq, &type);
++ err = irq_domain_translate_twocell(domain, fwspec, &hwirq, &type);
++ if (err)
++ return err;
+
+- fwspec.fwnode = domain->parent->fwnode;
+- fwspec.param_count = 1;
+- fwspec.param[0] = hwirq + priv->ht_vec_base;
++ parent_fwspec.fwnode = domain->parent->fwnode;
++ parent_fwspec.param_count = 1;
++ parent_fwspec.param[0] = hwirq + priv->ht_vec_base;
+
+- err = irq_domain_alloc_irqs_parent(domain, virq, 1, &fwspec);
++ err = irq_domain_alloc_irqs_parent(domain, virq, 1, &parent_fwspec);
+ if (err)
+ return err;
+
+--
+2.25.1
+
--- /dev/null
+From a7df0f820eee510e7891a01d15578239293c83cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 16:51:30 +0800
+Subject: irqchip/loongson-pch-pic: Fix the misused irq flow handler
+
+From: Huacai Chen <chenhc@lemote.com>
+
+[ Upstream commit ac62460c24126eb2442e3653a266ebbf05b004d8 ]
+
+Loongson PCH PIC is a standard level triggered PIC, and it need to clear
+interrupt during unmask.
+
+Fixes: ef8c01eb64ca6719da449dab0 ("irqchip: Add Loongson PCH PIC controller")
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Link: https://lore.kernel.org/r/1596099090-23516-6-git-send-email-chenhc@lemote.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-pic.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-pic.c b/drivers/irqchip/irq-loongson-pch-pic.c
+index 016f32c4cbe18..9bf6b9a5f7348 100644
+--- a/drivers/irqchip/irq-loongson-pch-pic.c
++++ b/drivers/irqchip/irq-loongson-pch-pic.c
+@@ -64,15 +64,6 @@ static void pch_pic_bitclr(struct pch_pic *priv, int offset, int bit)
+ raw_spin_unlock(&priv->pic_lock);
+ }
+
+-static void pch_pic_eoi_irq(struct irq_data *d)
+-{
+- u32 idx = PIC_REG_IDX(d->hwirq);
+- struct pch_pic *priv = irq_data_get_irq_chip_data(d);
+-
+- writel(BIT(PIC_REG_BIT(d->hwirq)),
+- priv->base + PCH_PIC_CLR + idx * 4);
+-}
+-
+ static void pch_pic_mask_irq(struct irq_data *d)
+ {
+ struct pch_pic *priv = irq_data_get_irq_chip_data(d);
+@@ -85,6 +76,9 @@ static void pch_pic_unmask_irq(struct irq_data *d)
+ {
+ struct pch_pic *priv = irq_data_get_irq_chip_data(d);
+
++ writel(BIT(PIC_REG_BIT(d->hwirq)),
++ priv->base + PCH_PIC_CLR + PIC_REG_IDX(d->hwirq) * 4);
++
+ irq_chip_unmask_parent(d);
+ pch_pic_bitclr(priv, PCH_PIC_MASK, d->hwirq);
+ }
+@@ -124,7 +118,6 @@ static struct irq_chip pch_pic_irq_chip = {
+ .irq_mask = pch_pic_mask_irq,
+ .irq_unmask = pch_pic_unmask_irq,
+ .irq_ack = irq_chip_ack_parent,
+- .irq_eoi = pch_pic_eoi_irq,
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+ .irq_set_type = pch_pic_set_type,
+ };
+@@ -153,7 +146,7 @@ static int pch_pic_alloc(struct irq_domain *domain, unsigned int virq,
+
+ irq_domain_set_info(domain, virq, hwirq,
+ &pch_pic_irq_chip, priv,
+- handle_fasteoi_ack_irq, NULL, NULL);
++ handle_level_irq, NULL, NULL);
+ irq_set_probe(virq);
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 9d357994a4024d6cb7a810a09c4a029a02aefdee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2020 17:50:16 +0800
+Subject: irqchip/ti-sci-inta: Fix return value about devm_ioremap_resource()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 4b127a14cb1385dd355c7673d975258d5d668922 ]
+
+When call function devm_ioremap_resource(), we should use IS_ERR()
+to check the return value and return PTR_ERR() if failed.
+
+Fixes: 9f1463b86c13 ("irqchip/ti-sci-inta: Add support for Interrupt Aggregator driver")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Link: https://lore.kernel.org/r/1591437017-5295-2-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-ti-sci-inta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-ti-sci-inta.c b/drivers/irqchip/irq-ti-sci-inta.c
+index 7e3ebf6ed2cd1..be0a35d917962 100644
+--- a/drivers/irqchip/irq-ti-sci-inta.c
++++ b/drivers/irqchip/irq-ti-sci-inta.c
+@@ -572,7 +572,7 @@ static int ti_sci_inta_irq_domain_probe(struct platform_device *pdev)
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ inta->base = devm_ioremap_resource(dev, res);
+ if (IS_ERR(inta->base))
+- return -ENODEV;
++ return PTR_ERR(inta->base);
+
+ domain = irq_domain_add_linear(dev_of_node(dev),
+ ti_sci_get_num_resources(inta->vint),
+--
+2.25.1
+
--- /dev/null
+From c6705ce457cb6b5ef3839ffc7f92a67dcc3aba1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 19:55:27 +0200
+Subject: iwlegacy: Check the return value of pcie_capability_read_*()
+
+From: Bolarinwa Olayemi Saheed <refactormyself@gmail.com>
+
+[ Upstream commit 9018fd7f2a73e9b290f48a56b421558fa31e8b75 ]
+
+On failure pcie_capability_read_dword() sets it's last parameter, val
+to 0. However, with Patch 14/14, it is possible that val is set to ~0 on
+failure. This would introduce a bug because (x & x) == (~0 & x).
+
+This bug can be avoided without changing the function's behaviour if the
+return value of pcie_capability_read_dword is checked to confirm success.
+
+Check the return value of pcie_capability_read_dword() to ensure success.
+
+Suggested-by: Bjorn Helgaas <bjorn@helgaas.com>
+Signed-off-by: Bolarinwa Olayemi Saheed <refactormyself@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200713175529.29715-3-refactormyself@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
+index 348c17ce72f5c..f78e062df572a 100644
+--- a/drivers/net/wireless/intel/iwlegacy/common.c
++++ b/drivers/net/wireless/intel/iwlegacy/common.c
+@@ -4286,8 +4286,8 @@ il_apm_init(struct il_priv *il)
+ * power savings, even without L1.
+ */
+ if (il->cfg->set_l0s) {
+- pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl);
+- if (lctl & PCI_EXP_LNKCTL_ASPM_L1) {
++ ret = pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl);
++ if (!ret && (lctl & PCI_EXP_LNKCTL_ASPM_L1)) {
+ /* L1-ASPM enabled; disable(!) L0S */
+ il_set_bit(il, CSR_GIO_REG,
+ CSR_GIO_REG_VAL_L0S_ENABLED);
+--
+2.25.1
+
--- /dev/null
+From bf95a2bd8f7b426406c0712248cad5783ee9d0d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:11:40 +0300
+Subject: kernfs: do not call fsnotify() with name without a parent
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 9991bb84b27a2594187898f261866cfc50255454 ]
+
+When creating an FS_MODIFY event on inode itself (not on parent)
+the file_name argument should be NULL.
+
+The change to send a non NULL name to inode itself was done on purpuse
+as part of another commit, as Tejun writes: "...While at it, supply the
+target file name to fsnotify() from kernfs_node->name.".
+
+But this is wrong practice and inconsistent with inotify behavior when
+watching a single file. When a child is being watched (as opposed to the
+parent directory) the inotify event should contain the watch descriptor,
+but not the file name.
+
+Fixes: df6a58c5c5aa ("kernfs: don't depend on d_find_any_alias()...")
+Link: https://lore.kernel.org/r/20200708111156.24659-5-amir73il@gmail.com
+Acked-by: Tejun Heo <tj@kernel.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
+index 06b342d8462bf..e23b3f62483c4 100644
+--- a/fs/kernfs/file.c
++++ b/fs/kernfs/file.c
+@@ -912,7 +912,7 @@ static void kernfs_notify_workfn(struct work_struct *work)
+ }
+
+ fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
+- &name, 0);
++ NULL, 0);
+ iput(inode);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From a94c904ff6dbee8a2639b199b01140f79726505a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2020 19:46:46 +0200
+Subject: kobject: Avoid premature parent object freeing in kobject_cleanup()
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 079ad2fb4bf9eba8a0aaab014b49705cd7f07c66 ]
+
+If kobject_del() is invoked by kobject_cleanup() to delete the
+target kobject, it may cause its parent kobject to be freed
+before invoking the target kobject's ->release() method, which
+effectively means freeing the parent before dealing with the
+child entirely.
+
+That is confusing at best and it may also lead to functional
+issues if the callers of kobject_cleanup() are not careful enough
+about the order in which these calls are made, so avoid the
+problem by making kobject_cleanup() drop the last reference to
+the target kobject's parent at the end, after invoking the target
+kobject's ->release() method.
+
+[ rjw: Rewrite the subject and changelog, make kobject_cleanup()
+ drop the parent reference only when __kobject_del() has been
+ called. ]
+
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Fixes: 7589238a8cf3 ("Revert "software node: Simplify software_node_release() function"")
+Suggested-by: Rafael J. Wysocki <rafael@kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/1908555.IiAGLGrh1Z@kreacher
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kobject.c | 33 +++++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 1e4b7382a88ed..3afb939f2a1cc 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -599,14 +599,7 @@ int kobject_move(struct kobject *kobj, struct kobject *new_parent)
+ }
+ EXPORT_SYMBOL_GPL(kobject_move);
+
+-/**
+- * kobject_del() - Unlink kobject from hierarchy.
+- * @kobj: object.
+- *
+- * This is the function that should be called to delete an object
+- * successfully added via kobject_add().
+- */
+-void kobject_del(struct kobject *kobj)
++static void __kobject_del(struct kobject *kobj)
+ {
+ struct kernfs_node *sd;
+ const struct kobj_type *ktype;
+@@ -632,9 +625,23 @@ void kobject_del(struct kobject *kobj)
+
+ kobj->state_in_sysfs = 0;
+ kobj_kset_leave(kobj);
+- kobject_put(kobj->parent);
+ kobj->parent = NULL;
+ }
++
++/**
++ * kobject_del() - Unlink kobject from hierarchy.
++ * @kobj: object.
++ *
++ * This is the function that should be called to delete an object
++ * successfully added via kobject_add().
++ */
++void kobject_del(struct kobject *kobj)
++{
++ struct kobject *parent = kobj->parent;
++
++ __kobject_del(kobj);
++ kobject_put(parent);
++}
+ EXPORT_SYMBOL(kobject_del);
+
+ /**
+@@ -670,6 +677,7 @@ EXPORT_SYMBOL(kobject_get_unless_zero);
+ */
+ static void kobject_cleanup(struct kobject *kobj)
+ {
++ struct kobject *parent = kobj->parent;
+ struct kobj_type *t = get_ktype(kobj);
+ const char *name = kobj->name;
+
+@@ -684,7 +692,10 @@ static void kobject_cleanup(struct kobject *kobj)
+ if (kobj->state_in_sysfs) {
+ pr_debug("kobject: '%s' (%p): auto cleanup kobject_del\n",
+ kobject_name(kobj), kobj);
+- kobject_del(kobj);
++ __kobject_del(kobj);
++ } else {
++ /* avoid dropping the parent reference unnecessarily */
++ parent = NULL;
+ }
+
+ if (t && t->release) {
+@@ -698,6 +709,8 @@ static void kobject_cleanup(struct kobject *kobj)
+ pr_debug("kobject: '%s': free name\n", name);
+ kfree_const(name);
+ }
++
++ kobject_put(parent);
+ }
+
+ #ifdef CONFIG_DEBUG_KOBJECT_RELEASE
+--
+2.25.1
+
--- /dev/null
+From d6002393f9b4d8fb909d79dd370b4c03be355e13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 13:41:29 -0700
+Subject: kunit: tool: fix broken default args in unit tests
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit 6816fe61bda8c819c368ad2002cd27172ecb79de ]
+
+Commit ddbd60c779b4 ("kunit: use --build_dir=.kunit as default") changed
+the default build directory for KUnit tests, but failed to update
+associated unit tests for kunit_tool, so update them.
+
+Fixes: ddbd60c779b4 ("kunit: use --build_dir=.kunit as default")
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/kunit/kunit_tool_test.py | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/kunit/kunit_tool_test.py b/tools/testing/kunit/kunit_tool_test.py
+index f9eeaea94cad1..ee942d80bdd02 100755
+--- a/tools/testing/kunit/kunit_tool_test.py
++++ b/tools/testing/kunit/kunit_tool_test.py
+@@ -258,14 +258,14 @@ class KUnitMainTest(unittest.TestCase):
+ def test_build_passes_args_pass(self):
+ kunit.main(['build'], self.linux_source_mock)
+ assert self.linux_source_mock.build_reconfig.call_count == 0
+- self.linux_source_mock.build_um_kernel.assert_called_once_with(False, 8, '', None)
++ self.linux_source_mock.build_um_kernel.assert_called_once_with(False, 8, '.kunit', None)
+ assert self.linux_source_mock.run_kernel.call_count == 0
+
+ def test_exec_passes_args_pass(self):
+ kunit.main(['exec'], self.linux_source_mock)
+ assert self.linux_source_mock.build_reconfig.call_count == 0
+ assert self.linux_source_mock.run_kernel.call_count == 1
+- self.linux_source_mock.run_kernel.assert_called_once_with(build_dir='', timeout=300)
++ self.linux_source_mock.run_kernel.assert_called_once_with(build_dir='.kunit', timeout=300)
+ self.print_mock.assert_any_call(StrContains('Testing complete.'))
+
+ def test_run_passes_args_pass(self):
+@@ -273,7 +273,7 @@ class KUnitMainTest(unittest.TestCase):
+ assert self.linux_source_mock.build_reconfig.call_count == 1
+ assert self.linux_source_mock.run_kernel.call_count == 1
+ self.linux_source_mock.run_kernel.assert_called_once_with(
+- build_dir='', timeout=300)
++ build_dir='.kunit', timeout=300)
+ self.print_mock.assert_any_call(StrContains('Testing complete.'))
+
+ def test_exec_passes_args_fail(self):
+@@ -313,7 +313,7 @@ class KUnitMainTest(unittest.TestCase):
+ def test_exec_timeout(self):
+ timeout = 3453
+ kunit.main(['exec', '--timeout', str(timeout)], self.linux_source_mock)
+- self.linux_source_mock.run_kernel.assert_called_once_with(build_dir='', timeout=timeout)
++ self.linux_source_mock.run_kernel.assert_called_once_with(build_dir='.kunit', timeout=timeout)
+ self.print_mock.assert_any_call(StrContains('Testing complete.'))
+
+ def test_run_timeout(self):
+@@ -321,7 +321,7 @@ class KUnitMainTest(unittest.TestCase):
+ kunit.main(['run', '--timeout', str(timeout)], self.linux_source_mock)
+ assert self.linux_source_mock.build_reconfig.call_count == 1
+ self.linux_source_mock.run_kernel.assert_called_once_with(
+- build_dir='', timeout=timeout)
++ build_dir='.kunit', timeout=timeout)
+ self.print_mock.assert_any_call(StrContains('Testing complete.'))
+
+ def test_run_builddir(self):
+--
+2.25.1
+
--- /dev/null
+From 1cb992fd5c8d507655200e33f6b8db7143e937ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 13:41:30 -0700
+Subject: kunit: tool: fix improper treatment of file location
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit d43c7fb05765152d4d4a39a8ef957c4ea14d8847 ]
+
+Commit 01397e822af4 ("kunit: Fix TabError, remove defconfig code and
+handle when there is no kunitconfig") and commit 45ba7a893ad8 ("kunit:
+kunit_tool: Separate out config/build/exec/parse") introduced two
+closely related issues which built off of each other: they excessively
+created the build directory when not present and modified a constant
+(constants in Python only exist by convention).
+
+Together these issues broken a number of unit tests for KUnit tool, so
+fix them.
+
+Fixed up commit log to fic checkpatch commit description style error.
+Shuah Khan <skhan@linuxfoundation.org>
+
+Fixes: 01397e822af4 ("kunit: Fix TabError, remove defconfig code and handle when there is no kunitconfig")
+Fixes: 45ba7a893ad8 ("kunit: kunit_tool: Separate out config/build/exec/parse")
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/kunit/kunit.py | 24 ------------------------
+ tools/testing/kunit/kunit_tool_test.py | 4 ++--
+ 2 files changed, 2 insertions(+), 26 deletions(-)
+
+diff --git a/tools/testing/kunit/kunit.py b/tools/testing/kunit/kunit.py
+index f9b769f3437dd..425ef40067e7e 100755
+--- a/tools/testing/kunit/kunit.py
++++ b/tools/testing/kunit/kunit.py
+@@ -240,12 +240,6 @@ def main(argv, linux=None):
+ if cli_args.subcommand == 'run':
+ if not os.path.exists(cli_args.build_dir):
+ os.mkdir(cli_args.build_dir)
+- kunit_kernel.kunitconfig_path = os.path.join(
+- cli_args.build_dir,
+- kunit_kernel.kunitconfig_path)
+-
+- if not os.path.exists(kunit_kernel.kunitconfig_path):
+- create_default_kunitconfig()
+
+ if not linux:
+ linux = kunit_kernel.LinuxSourceTree()
+@@ -263,12 +257,6 @@ def main(argv, linux=None):
+ if cli_args.build_dir:
+ if not os.path.exists(cli_args.build_dir):
+ os.mkdir(cli_args.build_dir)
+- kunit_kernel.kunitconfig_path = os.path.join(
+- cli_args.build_dir,
+- kunit_kernel.kunitconfig_path)
+-
+- if not os.path.exists(kunit_kernel.kunitconfig_path):
+- create_default_kunitconfig()
+
+ if not linux:
+ linux = kunit_kernel.LinuxSourceTree()
+@@ -285,12 +273,6 @@ def main(argv, linux=None):
+ if cli_args.build_dir:
+ if not os.path.exists(cli_args.build_dir):
+ os.mkdir(cli_args.build_dir)
+- kunit_kernel.kunitconfig_path = os.path.join(
+- cli_args.build_dir,
+- kunit_kernel.kunitconfig_path)
+-
+- if not os.path.exists(kunit_kernel.kunitconfig_path):
+- create_default_kunitconfig()
+
+ if not linux:
+ linux = kunit_kernel.LinuxSourceTree()
+@@ -309,12 +291,6 @@ def main(argv, linux=None):
+ if cli_args.build_dir:
+ if not os.path.exists(cli_args.build_dir):
+ os.mkdir(cli_args.build_dir)
+- kunit_kernel.kunitconfig_path = os.path.join(
+- cli_args.build_dir,
+- kunit_kernel.kunitconfig_path)
+-
+- if not os.path.exists(kunit_kernel.kunitconfig_path):
+- create_default_kunitconfig()
+
+ if not linux:
+ linux = kunit_kernel.LinuxSourceTree()
+diff --git a/tools/testing/kunit/kunit_tool_test.py b/tools/testing/kunit/kunit_tool_test.py
+index ee942d80bdd02..287c74d821c33 100755
+--- a/tools/testing/kunit/kunit_tool_test.py
++++ b/tools/testing/kunit/kunit_tool_test.py
+@@ -251,7 +251,7 @@ class KUnitMainTest(unittest.TestCase):
+ pass
+
+ def test_config_passes_args_pass(self):
+- kunit.main(['config'], self.linux_source_mock)
++ kunit.main(['config', '--build_dir=.kunit'], self.linux_source_mock)
+ assert self.linux_source_mock.build_reconfig.call_count == 1
+ assert self.linux_source_mock.run_kernel.call_count == 0
+
+@@ -326,7 +326,7 @@ class KUnitMainTest(unittest.TestCase):
+
+ def test_run_builddir(self):
+ build_dir = '.kunit'
+- kunit.main(['run', '--build_dir', build_dir], self.linux_source_mock)
++ kunit.main(['run', '--build_dir=.kunit'], self.linux_source_mock)
+ assert self.linux_source_mock.build_reconfig.call_count == 1
+ self.linux_source_mock.run_kernel.assert_called_once_with(
+ build_dir=build_dir, timeout=300)
+--
+2.25.1
+
--- /dev/null
+From ce283c47c43e332466d449197d7fcf876647d7b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 13:45:00 +0800
+Subject: leds: core: Flush scheduled work for system suspend
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 302a085c20194bfa7df52e0fe684ee0c41da02e6 ]
+
+Sometimes LED won't be turned off by LED_CORE_SUSPENDRESUME flag upon
+system suspend.
+
+led_set_brightness_nopm() uses schedule_work() to set LED brightness.
+However, there's no guarantee that the scheduled work gets executed
+because no one flushes the work.
+
+So flush the scheduled work to make sure LED gets turned off.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Fixes: 81fe8e5b73e3 ("leds: core: Add led_set_brightness_nosleep{nopm} functions")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-class.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 3363a6551a708..cc3929f858b68 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -173,6 +173,7 @@ void led_classdev_suspend(struct led_classdev *led_cdev)
+ {
+ led_cdev->flags |= LED_SUSPENDED;
+ led_set_brightness_nopm(led_cdev, 0);
++ flush_work(&led_cdev->set_brightness_work);
+ }
+ EXPORT_SYMBOL_GPL(led_classdev_suspend);
+
+--
+2.25.1
+
--- /dev/null
+From 3af83828db62b8f2f611d7c31b19109d78187467 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 May 2020 16:19:17 +0200
+Subject: leds: lm355x: avoid enum conversion warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 985b1f596f9ed56f42b8c2280005f943e1434c06 ]
+
+clang points out that doing arithmetic between diffent enums is usually
+a mistake:
+
+drivers/leds/leds-lm355x.c:167:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion]
+ reg_val = pdata->pin_tx2 | pdata->ntc_pin;
+ ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~
+drivers/leds/leds-lm355x.c:178:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion]
+ reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode;
+ ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~
+
+In this driver, it is intentional, so add a cast to hide the false-positive
+warning. It appears to be the only instance of this warning at the moment.
+
+Fixes: b98d13c72592 ("leds: Add new LED driver for lm355x chips")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lm355x.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c
+index 11ce052497514..b2eb2e1e9c04b 100644
+--- a/drivers/leds/leds-lm355x.c
++++ b/drivers/leds/leds-lm355x.c
+@@ -164,18 +164,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip)
+ /* input and output pins configuration */
+ switch (chip->type) {
+ case CHIP_LM3554:
+- reg_val = pdata->pin_tx2 | pdata->ntc_pin;
++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin;
+ ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val);
+ if (ret < 0)
+ goto out;
+- reg_val = pdata->pass_mode;
++ reg_val = (u32)pdata->pass_mode;
+ ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val);
+ if (ret < 0)
+ goto out;
+ break;
+
+ case CHIP_LM3556:
+- reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode;
++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin |
++ (u32)pdata->pass_mode;
+ ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val);
+ if (ret < 0)
+ goto out;
+--
+2.25.1
+
--- /dev/null
+From ba31fba873b1960f791950a330720409702e35de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 17:08:01 +0200
+Subject: libbpf: Fix register in PT_REGS MIPS macros
+
+From: Jerry Crunchtime <jerry.c.t@web.de>
+
+[ Upstream commit 1acf8f90ea7ee59006d0474275922145ac291331 ]
+
+The o32, n32 and n64 calling conventions require the return
+value to be stored in $v0 which maps to $2 register, i.e.,
+the register 2.
+
+Fixes: c1932cd ("bpf: Add MIPS support to samples/bpf.")
+Signed-off-by: Jerry Crunchtime <jerry.c.t@web.de>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/43707d31-0210-e8f0-9226-1af140907641@web.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf_tracing.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h
+index 58eceb884df33..eebf020cbe3e9 100644
+--- a/tools/lib/bpf/bpf_tracing.h
++++ b/tools/lib/bpf/bpf_tracing.h
+@@ -215,7 +215,7 @@ struct pt_regs;
+ #define PT_REGS_PARM5(x) ((x)->regs[8])
+ #define PT_REGS_RET(x) ((x)->regs[31])
+ #define PT_REGS_FP(x) ((x)->regs[30]) /* Works only with CONFIG_FRAME_POINTER */
+-#define PT_REGS_RC(x) ((x)->regs[1])
++#define PT_REGS_RC(x) ((x)->regs[2])
+ #define PT_REGS_SP(x) ((x)->regs[29])
+ #define PT_REGS_IP(x) ((x)->cp0_epc)
+
+@@ -226,7 +226,7 @@ struct pt_regs;
+ #define PT_REGS_PARM5_CORE(x) BPF_CORE_READ((x), regs[8])
+ #define PT_REGS_RET_CORE(x) BPF_CORE_READ((x), regs[31])
+ #define PT_REGS_FP_CORE(x) BPF_CORE_READ((x), regs[30])
+-#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), regs[1])
++#define PT_REGS_RC_CORE(x) BPF_CORE_READ((x), regs[2])
+ #define PT_REGS_SP_CORE(x) BPF_CORE_READ((x), regs[29])
+ #define PT_REGS_IP_CORE(x) BPF_CORE_READ((x), cp0_epc)
+
+--
+2.25.1
+
--- /dev/null
+From ed3e1dd083212a0fae4124991ec3fe69388f5160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 19:15:44 +0800
+Subject: liquidio: Fix wrong return value in cn23xx_get_pf_num()
+
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+[ Upstream commit aa027850a292ea65524b8fab83eb91a124ad362c ]
+
+On an error exit path, a negative error code should be returned
+instead of a positive return value.
+
+Fixes: 0c45d7fe12c7e ("liquidio: fix use of pf in pass-through mode in a virtual machine")
+Cc: Rick Farrington <ricardo.farrington@cavium.com>
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+index 43d11c38b38a9..4cddd628d41b2 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+@@ -1167,7 +1167,7 @@ static int cn23xx_get_pf_num(struct octeon_device *oct)
+ oct->pf_num = ((fdl_bit >> CN23XX_PCIE_SRIOV_FDL_BIT_POS) &
+ CN23XX_PCIE_SRIOV_FDL_MASK);
+ } else {
+- ret = EINVAL;
++ ret = -EINVAL;
+
+ /* Under some virtual environments, extended PCI regs are
+ * inaccessible, in which case the above read will have failed.
+--
+2.25.1
+
--- /dev/null
+From b68fbbf464da08644defd159da546b7399a29450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 13:37:01 -0700
+Subject: lkdtm: Avoid more compiler optimizations for bad writes
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 464e86b4abadfc490f426954b431e2ec6a9d7bd2 ]
+
+It seems at least Clang is able to throw away writes it knows are
+destined for read-only memory, which makes things like the WRITE_RO test
+fail, as the write gets elided. Instead, force the variable to be
+volatile, and make similar changes through-out other tests in an effort
+to avoid needing to repeat fixing these kinds of problems. Also includes
+pr_err() calls in failure paths so that kernel logs are more clear in
+the failure case.
+
+Reported-by: Prasad Sodagudi <psodagud@codeaurora.org>
+Suggested-by: Sami Tolvanen <samitolvanen@google.com>
+Fixes: 9ae113ce5faf ("lkdtm: add tests for additional page permissions")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20200625203704.317097-2-keescook@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/lkdtm/bugs.c | 11 +++++------
+ drivers/misc/lkdtm/perms.c | 22 +++++++++++++++-------
+ drivers/misc/lkdtm/usercopy.c | 7 +++++--
+ 3 files changed, 25 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c
+index 736675f0a2464..08c70281c380e 100644
+--- a/drivers/misc/lkdtm/bugs.c
++++ b/drivers/misc/lkdtm/bugs.c
+@@ -118,9 +118,8 @@ noinline void lkdtm_CORRUPT_STACK(void)
+ /* Use default char array length that triggers stack protection. */
+ char data[8] __aligned(sizeof(void *));
+
+- __lkdtm_CORRUPT_STACK(&data);
+-
+- pr_info("Corrupted stack containing char array ...\n");
++ pr_info("Corrupting stack containing char array ...\n");
++ __lkdtm_CORRUPT_STACK((void *)&data);
+ }
+
+ /* Same as above but will only get a canary with -fstack-protector-strong */
+@@ -131,9 +130,8 @@ noinline void lkdtm_CORRUPT_STACK_STRONG(void)
+ unsigned long *ptr;
+ } data __aligned(sizeof(void *));
+
+- __lkdtm_CORRUPT_STACK(&data);
+-
+- pr_info("Corrupted stack containing union ...\n");
++ pr_info("Corrupting stack containing union ...\n");
++ __lkdtm_CORRUPT_STACK((void *)&data);
+ }
+
+ void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
+@@ -248,6 +246,7 @@ void lkdtm_ARRAY_BOUNDS(void)
+
+ kfree(not_checked);
+ kfree(checked);
++ pr_err("FAIL: survived array bounds overflow!\n");
+ }
+
+ void lkdtm_CORRUPT_LIST_ADD(void)
+diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c
+index 62f76d506f040..2dede2ef658f3 100644
+--- a/drivers/misc/lkdtm/perms.c
++++ b/drivers/misc/lkdtm/perms.c
+@@ -57,6 +57,7 @@ static noinline void execute_location(void *dst, bool write)
+ }
+ pr_info("attempting bad execution at %px\n", func);
+ func();
++ pr_err("FAIL: func returned\n");
+ }
+
+ static void execute_user_location(void *dst)
+@@ -75,20 +76,22 @@ static void execute_user_location(void *dst)
+ return;
+ pr_info("attempting bad execution at %px\n", func);
+ func();
++ pr_err("FAIL: func returned\n");
+ }
+
+ void lkdtm_WRITE_RO(void)
+ {
+- /* Explicitly cast away "const" for the test. */
+- unsigned long *ptr = (unsigned long *)&rodata;
++ /* Explicitly cast away "const" for the test and make volatile. */
++ volatile unsigned long *ptr = (unsigned long *)&rodata;
+
+ pr_info("attempting bad rodata write at %px\n", ptr);
+ *ptr ^= 0xabcd1234;
++ pr_err("FAIL: survived bad write\n");
+ }
+
+ void lkdtm_WRITE_RO_AFTER_INIT(void)
+ {
+- unsigned long *ptr = &ro_after_init;
++ volatile unsigned long *ptr = &ro_after_init;
+
+ /*
+ * Verify we were written to during init. Since an Oops
+@@ -102,19 +105,21 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
+
+ pr_info("attempting bad ro_after_init write at %px\n", ptr);
+ *ptr ^= 0xabcd1234;
++ pr_err("FAIL: survived bad write\n");
+ }
+
+ void lkdtm_WRITE_KERN(void)
+ {
+ size_t size;
+- unsigned char *ptr;
++ volatile unsigned char *ptr;
+
+ size = (unsigned long)do_overwritten - (unsigned long)do_nothing;
+ ptr = (unsigned char *)do_overwritten;
+
+ pr_info("attempting bad %zu byte write at %px\n", size, ptr);
+- memcpy(ptr, (unsigned char *)do_nothing, size);
++ memcpy((void *)ptr, (unsigned char *)do_nothing, size);
+ flush_icache_range((unsigned long)ptr, (unsigned long)(ptr + size));
++ pr_err("FAIL: survived bad write\n");
+
+ do_overwritten();
+ }
+@@ -193,9 +198,11 @@ void lkdtm_ACCESS_USERSPACE(void)
+ pr_info("attempting bad read at %px\n", ptr);
+ tmp = *ptr;
+ tmp += 0xc0dec0de;
++ pr_err("FAIL: survived bad read\n");
+
+ pr_info("attempting bad write at %px\n", ptr);
+ *ptr = tmp;
++ pr_err("FAIL: survived bad write\n");
+
+ vm_munmap(user_addr, PAGE_SIZE);
+ }
+@@ -203,19 +210,20 @@ void lkdtm_ACCESS_USERSPACE(void)
+ void lkdtm_ACCESS_NULL(void)
+ {
+ unsigned long tmp;
+- unsigned long *ptr = (unsigned long *)NULL;
++ volatile unsigned long *ptr = (unsigned long *)NULL;
+
+ pr_info("attempting bad read at %px\n", ptr);
+ tmp = *ptr;
+ tmp += 0xc0dec0de;
++ pr_err("FAIL: survived bad read\n");
+
+ pr_info("attempting bad write at %px\n", ptr);
+ *ptr = tmp;
++ pr_err("FAIL: survived bad write\n");
+ }
+
+ void __init lkdtm_perms_init(void)
+ {
+ /* Make sure we can write to __ro_after_init values during __init */
+ ro_after_init |= 0xAA;
+-
+ }
+diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
+index e172719dd86d0..b833367a45d05 100644
+--- a/drivers/misc/lkdtm/usercopy.c
++++ b/drivers/misc/lkdtm/usercopy.c
+@@ -304,19 +304,22 @@ void lkdtm_USERCOPY_KERNEL(void)
+ return;
+ }
+
+- pr_info("attempting good copy_to_user from kernel rodata\n");
++ pr_info("attempting good copy_to_user from kernel rodata: %px\n",
++ test_text);
+ if (copy_to_user((void __user *)user_addr, test_text,
+ unconst + sizeof(test_text))) {
+ pr_warn("copy_to_user failed unexpectedly?!\n");
+ goto free_user;
+ }
+
+- pr_info("attempting bad copy_to_user from kernel text\n");
++ pr_info("attempting bad copy_to_user from kernel text: %px\n",
++ vm_mmap);
+ if (copy_to_user((void __user *)user_addr, vm_mmap,
+ unconst + PAGE_SIZE)) {
+ pr_warn("copy_to_user failed, but lacked Oops\n");
+ goto free_user;
+ }
++ pr_err("FAIL: survived bad copy_to_user()\n");
+
+ free_user:
+ vm_munmap(user_addr, PAGE_SIZE);
+--
+2.25.1
+
--- /dev/null
+From a477b3c40b28c4a242901443e6ae57db31a5ea0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 13:37:04 -0700
+Subject: lkdtm: Make arch-specific tests always available
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit ae56942c14740c2963222efdc36c667ab19555ef ]
+
+I'd like arch-specific tests to XFAIL when on a mismatched architecture
+so that we can more easily compare test coverage across all systems.
+Lacking kernel configs or CPU features count as a FAIL, not an XFAIL.
+
+Additionally fixes a build failure under 32-bit UML.
+
+Fixes: b09511c253e5 ("lkdtm: Add a DOUBLE_FAULT crash type on x86")
+Fixes: cea23efb4de2 ("lkdtm/bugs: Make double-fault test always available")
+Fixes: 6cb6982f42cb ("lkdtm: arm64: test kernel pointer authentication")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20200625203704.317097-5-keescook@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/lkdtm/bugs.c | 38 ++++++++++++++-----------
+ drivers/misc/lkdtm/lkdtm.h | 2 --
+ tools/testing/selftests/lkdtm/tests.txt | 1 +
+ 3 files changed, 22 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c
+index 08c70281c380e..10338800f6be1 100644
+--- a/drivers/misc/lkdtm/bugs.c
++++ b/drivers/misc/lkdtm/bugs.c
+@@ -13,7 +13,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/slab.h>
+
+-#ifdef CONFIG_X86_32
++#if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML)
+ #include <asm/desc.h>
+ #endif
+
+@@ -418,7 +418,7 @@ void lkdtm_UNSET_SMEP(void)
+
+ void lkdtm_DOUBLE_FAULT(void)
+ {
+-#ifdef CONFIG_X86_32
++#if IS_ENABLED(CONFIG_X86_32) && !IS_ENABLED(CONFIG_UML)
+ /*
+ * Trigger #DF by setting the stack limit to zero. This clobbers
+ * a GDT TLS slot, which is okay because the current task will die
+@@ -453,38 +453,42 @@ void lkdtm_DOUBLE_FAULT(void)
+ #endif
+ }
+
+-#ifdef CONFIG_ARM64_PTR_AUTH
++#ifdef CONFIG_ARM64
+ static noinline void change_pac_parameters(void)
+ {
+- /* Reset the keys of current task */
+- ptrauth_thread_init_kernel(current);
+- ptrauth_thread_switch_kernel(current);
++ if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH)) {
++ /* Reset the keys of current task */
++ ptrauth_thread_init_kernel(current);
++ ptrauth_thread_switch_kernel(current);
++ }
+ }
++#endif
+
+-#define CORRUPT_PAC_ITERATE 10
+ noinline void lkdtm_CORRUPT_PAC(void)
+ {
++#ifdef CONFIG_ARM64
++#define CORRUPT_PAC_ITERATE 10
+ int i;
+
++ if (!IS_ENABLED(CONFIG_ARM64_PTR_AUTH))
++ pr_err("FAIL: kernel not built with CONFIG_ARM64_PTR_AUTH\n");
++
+ if (!system_supports_address_auth()) {
+- pr_err("FAIL: arm64 pointer authentication feature not present\n");
++ pr_err("FAIL: CPU lacks pointer authentication feature\n");
+ return;
+ }
+
+- pr_info("Change the PAC parameters to force function return failure\n");
++ pr_info("changing PAC parameters to force function return failure...\n");
+ /*
+- * Pac is a hash value computed from input keys, return address and
++ * PAC is a hash value computed from input keys, return address and
+ * stack pointer. As pac has fewer bits so there is a chance of
+ * collision, so iterate few times to reduce the collision probability.
+ */
+ for (i = 0; i < CORRUPT_PAC_ITERATE; i++)
+ change_pac_parameters();
+
+- pr_err("FAIL: %s test failed. Kernel may be unstable from here\n", __func__);
+-}
+-#else /* !CONFIG_ARM64_PTR_AUTH */
+-noinline void lkdtm_CORRUPT_PAC(void)
+-{
+- pr_err("FAIL: arm64 pointer authentication config disabled\n");
+-}
++ pr_err("FAIL: survived PAC changes! Kernel may be unstable from here\n");
++#else
++ pr_err("XFAIL: this test is arm64-only\n");
+ #endif
++}
+diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h
+index 601a2156a0d48..8878538b2c132 100644
+--- a/drivers/misc/lkdtm/lkdtm.h
++++ b/drivers/misc/lkdtm/lkdtm.h
+@@ -31,9 +31,7 @@ void lkdtm_CORRUPT_USER_DS(void);
+ void lkdtm_STACK_GUARD_PAGE_LEADING(void);
+ void lkdtm_STACK_GUARD_PAGE_TRAILING(void);
+ void lkdtm_UNSET_SMEP(void);
+-#ifdef CONFIG_X86_32
+ void lkdtm_DOUBLE_FAULT(void);
+-#endif
+ void lkdtm_CORRUPT_PAC(void);
+
+ /* lkdtm_heap.c */
+diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selftests/lkdtm/tests.txt
+index 92ca32143ae5f..9d266e79c6a27 100644
+--- a/tools/testing/selftests/lkdtm/tests.txt
++++ b/tools/testing/selftests/lkdtm/tests.txt
+@@ -14,6 +14,7 @@ STACK_GUARD_PAGE_LEADING
+ STACK_GUARD_PAGE_TRAILING
+ UNSET_SMEP CR4 bits went missing
+ DOUBLE_FAULT
++CORRUPT_PAC
+ UNALIGNED_LOAD_STORE_WRITE
+ #OVERWRITE_ALLOCATION Corrupts memory on failure
+ #WRITE_AFTER_FREE Corrupts memory on failure
+--
+2.25.1
+
--- /dev/null
+From af8db9ef16ec13f15cac718d26cc1fb47c3b7082 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 20:47:27 +0000
+Subject: loop: be paranoid on exit and prevent new additions / removals
+
+From: Luis Chamberlain <mcgrof@kernel.org>
+
+[ Upstream commit 200f93377220504c5e56754823e7adfea6037f1a ]
+
+Be pedantic on removal as well and hold the mutex.
+This should prevent uses of addition while we exit.
+
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 475e1a738560d..776083963ee6c 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -2402,6 +2402,8 @@ static void __exit loop_exit(void)
+
+ range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
+
++ mutex_lock(&loop_ctl_mutex);
++
+ idr_for_each(&loop_index_idr, &loop_exit_cb, NULL);
+ idr_destroy(&loop_index_idr);
+
+@@ -2409,6 +2411,8 @@ static void __exit loop_exit(void)
+ unregister_blkdev(LOOP_MAJOR, "loop");
+
+ misc_deregister(&loop_misc);
++
++ mutex_unlock(&loop_ctl_mutex);
+ }
+
+ module_init(loop_init);
+--
+2.25.1
+
--- /dev/null
+From 3d38d2eb37a3e7fe565270f51b5c90d82cf11a4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 09:12:13 +1000
+Subject: m68k: mac: Don't send IOP message until channel is idle
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit aeb445bf2194d83e12e85bf5c65baaf1f093bd8f ]
+
+In the following sequence of calls, iop_do_send() gets called when the
+"send" channel is not in the IOP_MSG_IDLE state:
+
+ iop_ism_irq()
+ iop_handle_send()
+ (msg->handler)()
+ iop_send_message()
+ iop_do_send()
+
+Avoid this by testing the channel state before calling iop_do_send().
+
+When sending, and iop_send_queue is empty, call iop_do_send() because
+the channel is idle. If iop_send_queue is not empty, iop_do_send() will
+get called later by iop_handle_send().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Cc: Joshua Thompson <funaho@jurai.org>
+Link: https://lore.kernel.org/r/6d667c39e53865661fa5a48f16829d18ed8abe54.1590880333.git.fthain@telegraphics.com.au
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/mac/iop.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
+index d3775afb0f076..754f6478c30d0 100644
+--- a/arch/m68k/mac/iop.c
++++ b/arch/m68k/mac/iop.c
+@@ -415,7 +415,8 @@ static void iop_handle_send(uint iop_num, uint chan)
+ msg->status = IOP_MSGSTATUS_UNUSED;
+ msg = msg->next;
+ iop_send_queue[iop_num][chan] = msg;
+- if (msg) iop_do_send(msg);
++ if (msg && iop_readb(iop, IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE)
++ iop_do_send(msg);
+ }
+
+ /*
+@@ -489,16 +490,12 @@ int iop_send_message(uint iop_num, uint chan, void *privdata,
+
+ if (!(q = iop_send_queue[iop_num][chan])) {
+ iop_send_queue[iop_num][chan] = msg;
++ iop_do_send(msg);
+ } else {
+ while (q->next) q = q->next;
+ q->next = msg;
+ }
+
+- if (iop_readb(iop_base[iop_num],
+- IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) {
+- iop_do_send(msg);
+- }
+-
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 28605d2a5c1d8c4f57f9e16fb99ddaab7afd5903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 09:12:13 +1000
+Subject: m68k: mac: Fix IOP status/control register writes
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 931fc82a6aaf4e2e4a5490addaa6a090d78c24a7 ]
+
+When writing values to the IOP status/control register make sure those
+values do not have any extraneous bits that will clear interrupt flags.
+
+To place the SCC IOP into bypass mode would be desirable but this is not
+achieved by writing IOP_DMAINACTIVE | IOP_RUN | IOP_AUTOINC | IOP_BYPASS
+to the control register. Drop this ineffective register write.
+
+Remove the flawed and unused iop_bypass() function. Make use of the
+unused iop_stop() function.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Cc: Joshua Thompson <funaho@jurai.org>
+Link: https://lore.kernel.org/r/09bcb7359a1719a18b551ee515da3c4c3cf709e6.1590880333.git.fthain@telegraphics.com.au
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/mac/iop.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
+index 754f6478c30d0..bfc8daf507443 100644
+--- a/arch/m68k/mac/iop.c
++++ b/arch/m68k/mac/iop.c
+@@ -183,7 +183,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8
+
+ static __inline__ void iop_stop(volatile struct mac_iop *iop)
+ {
+- iop->status_ctrl &= ~IOP_RUN;
++ iop->status_ctrl = IOP_AUTOINC;
+ }
+
+ static __inline__ void iop_start(volatile struct mac_iop *iop)
+@@ -191,14 +191,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop)
+ iop->status_ctrl = IOP_RUN | IOP_AUTOINC;
+ }
+
+-static __inline__ void iop_bypass(volatile struct mac_iop *iop)
+-{
+- iop->status_ctrl |= IOP_BYPASS;
+-}
+-
+ static __inline__ void iop_interrupt(volatile struct mac_iop *iop)
+ {
+- iop->status_ctrl |= IOP_IRQ;
++ iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC;
+ }
+
+ static int iop_alive(volatile struct mac_iop *iop)
+@@ -244,7 +239,6 @@ void __init iop_preinit(void)
+ } else {
+ iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA;
+ }
+- iop_base[IOP_NUM_SCC]->status_ctrl = 0x87;
+ iop_scc_present = 1;
+ } else {
+ iop_base[IOP_NUM_SCC] = NULL;
+@@ -256,7 +250,7 @@ void __init iop_preinit(void)
+ } else {
+ iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA;
+ }
+- iop_base[IOP_NUM_ISM]->status_ctrl = 0;
++ iop_stop(iop_base[IOP_NUM_ISM]);
+ iop_ism_present = 1;
+ } else {
+ iop_base[IOP_NUM_ISM] = NULL;
+--
+2.25.1
+
--- /dev/null
+From e75c5ffee4390066e538b3b549af0633ed370d94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jun 2020 14:23:12 +1000
+Subject: macintosh/via-macii: Access autopoll_devs when inside lock
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 59ea38f6b3af5636edf541768a1ed721eeaca99e ]
+
+The interrupt handler should be excluded when accessing the autopoll_devs
+variable.
+
+Fixes: d95fd5fce88f0 ("m68k: Mac II ADB fixes") # v5.0+
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/5952dd8a9bc9de90f1acc4790c51dd42b4c98065.1593318192.git.fthain@telegraphics.com.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/via-macii.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c
+index ac824d7b2dcfc..6aa903529570d 100644
+--- a/drivers/macintosh/via-macii.c
++++ b/drivers/macintosh/via-macii.c
+@@ -270,15 +270,12 @@ static int macii_autopoll(int devs)
+ unsigned long flags;
+ int err = 0;
+
++ local_irq_save(flags);
++
+ /* bit 1 == device 1, and so on. */
+ autopoll_devs = devs & 0xFFFE;
+
+- if (!autopoll_devs)
+- return 0;
+-
+- local_irq_save(flags);
+-
+- if (current_req == NULL) {
++ if (autopoll_devs && !current_req) {
+ /* Send a Talk Reg 0. The controller will repeatedly transmit
+ * this as long as it is idle.
+ */
+--
+2.25.1
+
--- /dev/null
+From 93601fe37bb89b8ea90307ebf2d02071b8c04aeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 11:29:29 +0800
+Subject: md-cluster: fix wild pointer of unlock_all_bitmaps()
+
+From: Zhao Heming <heming.zhao@suse.com>
+
+[ Upstream commit 60f80d6f2d07a6d8aee485a1d1252327eeee0c81 ]
+
+reproduction steps:
+```
+node1 # mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda
+/dev/sdb
+node2 # mdadm -A /dev/md0 /dev/sda /dev/sdb
+node1 # mdadm -G /dev/md0 -b none
+mdadm: failed to remove clustered bitmap.
+node1 # mdadm -S --scan
+^C <==== mdadm hung & kernel crash
+```
+
+kernel stack:
+```
+[ 335.230657] general protection fault: 0000 [#1] SMP NOPTI
+[...]
+[ 335.230848] Call Trace:
+[ 335.230873] ? unlock_all_bitmaps+0x5/0x70 [md_cluster]
+[ 335.230886] unlock_all_bitmaps+0x3d/0x70 [md_cluster]
+[ 335.230899] leave+0x10f/0x190 [md_cluster]
+[ 335.230932] ? md_super_wait+0x93/0xa0 [md_mod]
+[ 335.230947] ? leave+0x5/0x190 [md_cluster]
+[ 335.230973] md_cluster_stop+0x1a/0x30 [md_mod]
+[ 335.230999] md_bitmap_free+0x142/0x150 [md_mod]
+[ 335.231013] ? _cond_resched+0x15/0x40
+[ 335.231025] ? mutex_lock+0xe/0x30
+[ 335.231056] __md_stop+0x1c/0xa0 [md_mod]
+[ 335.231083] do_md_stop+0x160/0x580 [md_mod]
+[ 335.231119] ? 0xffffffffc05fb078
+[ 335.231148] md_ioctl+0xa04/0x1930 [md_mod]
+[ 335.231165] ? filename_lookup+0xf2/0x190
+[ 335.231179] blkdev_ioctl+0x93c/0xa10
+[ 335.231205] ? _cond_resched+0x15/0x40
+[ 335.231214] ? __check_object_size+0xd4/0x1a0
+[ 335.231224] block_ioctl+0x39/0x40
+[ 335.231243] do_vfs_ioctl+0xa0/0x680
+[ 335.231253] ksys_ioctl+0x70/0x80
+[ 335.231261] __x64_sys_ioctl+0x16/0x20
+[ 335.231271] do_syscall_64+0x65/0x1f0
+[ 335.231278] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+```
+
+Signed-off-by: Zhao Heming <heming.zhao@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-cluster.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 813a99ffa86f8..73fd50e779754 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -1518,6 +1518,7 @@ static void unlock_all_bitmaps(struct mddev *mddev)
+ }
+ }
+ kfree(cinfo->other_bitmap_lockres);
++ cinfo->other_bitmap_lockres = NULL;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 6e423cc739f6613cbcf9af521b8cc7f88a21ee91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 12:35:02 +0100
+Subject: md: raid0/linear: fix dereference before null check on pointer mddev
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9a5a85972c073f720d81a7ebd08bfe278e6e16db ]
+
+Pointer mddev is being dereferenced with a test_bit call before mddev
+is being null checked, this may cause a null pointer dereference. Fix
+this by moving the null pointer checks to sanity check mddev before
+it is dereferenced.
+
+Addresses-Coverity: ("Dereference before null check")
+Fixes: 62f7b1989c02 ("md raid0/linear: Mark array as 'broken' and fail BIOs if a member is gone")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Guilherme G. Piccoli <gpiccoli@canonical.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index f567f536b529b..90756450b9588 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -470,17 +470,18 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
+ struct mddev *mddev = bio->bi_disk->private_data;
+ unsigned int sectors;
+
+- if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) {
++ if (mddev == NULL || mddev->pers == NULL) {
+ bio_io_error(bio);
+ return BLK_QC_T_NONE;
+ }
+
+- blk_queue_split(q, &bio);
+-
+- if (mddev == NULL || mddev->pers == NULL) {
++ if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) {
+ bio_io_error(bio);
+ return BLK_QC_T_NONE;
+ }
++
++ blk_queue_split(q, &bio);
++
+ if (mddev->ro == 1 && unlikely(rw == WRITE)) {
+ if (bio_sectors(bio) != 0)
+ bio->bi_status = BLK_STS_IOERR;
+--
+2.25.1
+
--- /dev/null
+From b85dd7971a1c86bf7a21fedc1f581822aca08b9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 16:30:07 +0200
+Subject: media: allegro: Fix some NULL vs IS_ERR() checks in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d93d45ab716e4107056be54969c8c70e50a8346d ]
+
+The devm_ioremap() function doesn't return error pointers, it returns
+NULL on error.
+
+Fixes: f20387dfd065 ("media: allegro: add Allegro DVT video IP core driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/allegro-dvt/allegro-core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c
+index 70f133a842ddf..3ed66aae741d5 100644
+--- a/drivers/staging/media/allegro-dvt/allegro-core.c
++++ b/drivers/staging/media/allegro-dvt/allegro-core.c
+@@ -3065,9 +3065,9 @@ static int allegro_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+ regs = devm_ioremap(&pdev->dev, res->start, resource_size(res));
+- if (IS_ERR(regs)) {
++ if (!regs) {
+ dev_err(&pdev->dev, "failed to map registers\n");
+- return PTR_ERR(regs);
++ return -ENOMEM;
+ }
+ dev->regmap = devm_regmap_init_mmio(&pdev->dev, regs,
+ &allegro_regmap_config);
+@@ -3085,9 +3085,9 @@ static int allegro_probe(struct platform_device *pdev)
+ sram_regs = devm_ioremap(&pdev->dev,
+ sram_res->start,
+ resource_size(sram_res));
+- if (IS_ERR(sram_regs)) {
++ if (!sram_regs) {
+ dev_err(&pdev->dev, "failed to map sram\n");
+- return PTR_ERR(sram_regs);
++ return -ENOMEM;
+ }
+ dev->sram = devm_regmap_init_mmio(&pdev->dev, sram_regs,
+ &allegro_sram_config);
+--
+2.25.1
+
--- /dev/null
+From 137c6aee302d03304bec51f8fc52961a7fdf7329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 13:46:36 +0200
+Subject: media: cros-ec-cec: do not bail on device_init_wakeup failure
+
+From: Dariusz Marcinkiewicz <darekm@google.com>
+
+[ Upstream commit 6f01dfb760c027d5dd6199d91ee9599f2676b5c6 ]
+
+Do not fail probing when device_init_wakeup fails.
+
+device_init_wakeup fails when the device is already enabled as wakeup
+device. Hence, the driver fails to probe the device if:
+- The device has already been enabled for wakeup (by e.g. sysfs)
+- The driver has been unloaded and is being loaded again.
+
+This goal of the patch is to fix the above cases.
+
+Overwhelming majority of the drivers do not check device_init_wakeup
+return code.
+
+Fixes: cd70de2d356ee ("media: platform: Add ChromeOS EC CEC driver")
+Signed-off-by: Dariusz Marcinkiewicz <darekm@google.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/platform/cros-ec/cros-ec-cec.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
+index 0e7e2772f08f9..2d95e16cd2489 100644
+--- a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
++++ b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
+@@ -277,11 +277,7 @@ static int cros_ec_cec_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, cros_ec_cec);
+ cros_ec_cec->cros_ec = cros_ec;
+
+- ret = device_init_wakeup(&pdev->dev, 1);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to initialize wakeup\n");
+- return ret;
+- }
++ device_init_wakeup(&pdev->dev, 1);
+
+ cros_ec_cec->adap = cec_allocate_adapter(&cros_ec_cec_ops, cros_ec_cec,
+ DRV_NAME,
+--
+2.25.1
+
--- /dev/null
+From d249c2b5509cd868232b11b2e8a368de0d3a3993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 May 2020 23:33:14 +0200
+Subject: media: cxusb-analog: fix V4L2 dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 1a55caf010c46d4f2073f9e92e97ef65358c16bf ]
+
+CONFIG_DVB_USB_CXUSB_ANALOG is a 'bool' symbol with a dependency on the
+tristate CONFIG_VIDEO_V4L2, which means it can be enabled as =y even
+when its dependency is =m. This leads to a link failure:
+
+drivers/media/usb/dvb-usb/cxusb-analog.o: In function `cxusb_medion_analog_init':
+cxusb-analog.c:(.text+0x92): undefined reference to `v4l2_subdev_call_wrappers'
+drivers/media/usb/dvb-usb/cxusb-analog.o: In function `cxusb_medion_register_analog':
+cxusb-analog.c:(.text+0x466): undefined reference to `v4l2_device_register'
+cxusb-analog.c:(.text+0x4c3): undefined reference to `v4l2_i2c_new_subdev'
+cxusb-analog.c:(.text+0x4fb): undefined reference to `v4l2_subdev_call_wrappers'
+...
+
+Change the dependency only disallow the analog portion of the driver
+in that configuration.
+
+Fixes: e478d4054054 ("media: cxusb: add analog mode support for Medion MD95700")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/usb/dvb-usb/Kconfig b/drivers/media/usb/dvb-usb/Kconfig
+index 15d29c91662f3..25ba03edcb5c6 100644
+--- a/drivers/media/usb/dvb-usb/Kconfig
++++ b/drivers/media/usb/dvb-usb/Kconfig
+@@ -151,6 +151,7 @@ config DVB_USB_CXUSB
+ config DVB_USB_CXUSB_ANALOG
+ bool "Analog support for the Conexant USB2.0 hybrid reference design"
+ depends on DVB_USB_CXUSB && VIDEO_V4L2
++ depends on VIDEO_V4L2=y || VIDEO_V4L2=DVB_USB_CXUSB
+ select VIDEO_CX25840
+ select VIDEOBUF2_VMALLOC
+ help
+--
+2.25.1
+
--- /dev/null
+From 80c0f64c5f935d4fe175b8e7139de452cf30f386 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 08:41:47 +0200
+Subject: media: exynos4-is: Add missed check for pinctrl_lookup_state()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 18ffec750578f7447c288647d7282c7d12b1d969 ]
+
+fimc_md_get_pinctrl() misses a check for pinctrl_lookup_state().
+Add the missed check to fix it.
+
+Fixes: 4163851f7b99 ("[media] s5p-fimc: Use pinctrl API for camera ports configuration]")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/exynos4-is/media-dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 9aaf3b8060d50..9c31d950cddf7 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1270,6 +1270,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
+
+ pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
+ PINCTRL_STATE_IDLE);
++ if (IS_ERR(pctl->state_idle))
++ return PTR_ERR(pctl->state_idle);
++
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From d5a66b0485fff87e93ca4d7060c9e56f1b2fbfc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 May 2020 16:40:22 +0200
+Subject: media: firewire: Using uninitialized values in node_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 2505a210fc126599013aec2be741df20aaacc490 ]
+
+If fw_csr_string() returns -ENOENT, then "name" is uninitialized. So
+then the "strlen(model_names[i]) <= name_len" is true because strlen()
+is unsigned and -ENOENT is type promoted to a very high positive value.
+Then the "strncmp(name, model_names[i], name_len)" uses uninitialized
+data because "name" is uninitialized.
+
+Fixes: 92374e886c75 ("[media] firedtv: drop obsolete backend abstraction")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/firewire/firedtv-fw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
+index 97144734eb052..3f1ca40b9b987 100644
+--- a/drivers/media/firewire/firedtv-fw.c
++++ b/drivers/media/firewire/firedtv-fw.c
+@@ -272,6 +272,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
+
+ name_len = fw_csr_string(unit->directory, CSR_MODEL,
+ name, sizeof(name));
++ if (name_len < 0)
++ return name_len;
+ for (i = ARRAY_SIZE(model_names); --i; )
+ if (strlen(model_names[i]) <= name_len &&
+ strncmp(name, model_names[i], name_len) == 0)
+--
+2.25.1
+
--- /dev/null
+From 9d45ae9e288b8e80e4e2041b9edf9cca2a704504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 18:40:48 +0200
+Subject: media: marvell-ccic: Add missed v4l2_async_notifier_cleanup()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 4603a5b4a87ccd6fb90cbfa10195291cfcf6ba34 ]
+
+mccic_register() forgets to cleanup the notifier in its error handler.
+mccic_shutdown() also misses calling v4l2_async_notifier_cleanup().
+Add the missed calls to fix them.
+
+Fixes: 3eefe36cc00c ("media: marvell-ccic: use async notifier to get the sensor")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/marvell-ccic/mcam-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c
+index 09775b6624c6b..326e79b8531c5 100644
+--- a/drivers/media/platform/marvell-ccic/mcam-core.c
++++ b/drivers/media/platform/marvell-ccic/mcam-core.c
+@@ -1940,6 +1940,7 @@ int mccic_register(struct mcam_camera *cam)
+ out:
+ v4l2_async_notifier_unregister(&cam->notifier);
+ v4l2_device_unregister(&cam->v4l2_dev);
++ v4l2_async_notifier_cleanup(&cam->notifier);
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(mccic_register);
+@@ -1961,6 +1962,7 @@ void mccic_shutdown(struct mcam_camera *cam)
+ v4l2_ctrl_handler_free(&cam->ctrl_handler);
+ v4l2_async_notifier_unregister(&cam->notifier);
+ v4l2_device_unregister(&cam->v4l2_dev);
++ v4l2_async_notifier_cleanup(&cam->notifier);
+ }
+ EXPORT_SYMBOL_GPL(mccic_shutdown);
+
+--
+2.25.1
+
--- /dev/null
+From 64f0742d3de405e22fe6fddf47762d95d437a70c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 14:39:14 +0200
+Subject: media: mtk-mdp: Fix a refcounting bug on error in init
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit dd4eddc4ba31fbf4554fc5fa12d3a553b50e1469 ]
+
+We need to call of_node_put(comp->dev_node); on the error paths in this
+function.
+
+Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-mdp/mtk_mdp_comp.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c b/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c
+index 58abfbdfb82d3..90b6d939f3adb 100644
+--- a/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c
++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_comp.c
+@@ -96,6 +96,7 @@ int mtk_mdp_comp_init(struct device *dev, struct device_node *node,
+ {
+ struct device_node *larb_node;
+ struct platform_device *larb_pdev;
++ int ret;
+ int i;
+
+ if (comp_id < 0 || comp_id >= MTK_MDP_COMP_ID_MAX) {
+@@ -113,8 +114,8 @@ int mtk_mdp_comp_init(struct device *dev, struct device_node *node,
+ if (IS_ERR(comp->clk[i])) {
+ if (PTR_ERR(comp->clk[i]) != -EPROBE_DEFER)
+ dev_err(dev, "Failed to get clock\n");
+-
+- return PTR_ERR(comp->clk[i]);
++ ret = PTR_ERR(comp->clk[i]);
++ goto put_dev;
+ }
+
+ /* Only RDMA needs two clocks */
+@@ -133,20 +134,27 @@ int mtk_mdp_comp_init(struct device *dev, struct device_node *node,
+ if (!larb_node) {
+ dev_err(dev,
+ "Missing mediadek,larb phandle in %pOF node\n", node);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_dev;
+ }
+
+ larb_pdev = of_find_device_by_node(larb_node);
+ if (!larb_pdev) {
+ dev_warn(dev, "Waiting for larb device %pOF\n", larb_node);
+ of_node_put(larb_node);
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto put_dev;
+ }
+ of_node_put(larb_node);
+
+ comp->larb_dev = &larb_pdev->dev;
+
+ return 0;
++
++put_dev:
++ of_node_put(comp->dev_node);
++
++ return ret;
+ }
+
+ void mtk_mdp_comp_deinit(struct device *dev, struct mtk_mdp_comp *comp)
+--
+2.25.1
+
--- /dev/null
+From eae29b66dfa9588103b0a5c090e26e3d91f72a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 18:41:22 +0200
+Subject: media: omap3isp: Add missed v4l2_ctrl_handler_free() for
+ preview_init_entities()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit dc7690a73017e1236202022e26a6aa133f239c8c ]
+
+preview_init_entities() does not call v4l2_ctrl_handler_free() when
+it fails.
+Add the missed function to fix it.
+
+Fixes: de1135d44f4f ("[media] omap3isp: CCDC, preview engine and resizer")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/isppreview.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
+index 4dbdf3180d108..607b7685c982f 100644
+--- a/drivers/media/platform/omap3isp/isppreview.c
++++ b/drivers/media/platform/omap3isp/isppreview.c
+@@ -2287,7 +2287,7 @@ static int preview_init_entities(struct isp_prev_device *prev)
+ me->ops = &preview_media_ops;
+ ret = media_entity_pads_init(me, PREV_PADS_NUM, pads);
+ if (ret < 0)
+- return ret;
++ goto error_handler_free;
+
+ preview_init_formats(sd, NULL);
+
+@@ -2320,6 +2320,8 @@ static int preview_init_entities(struct isp_prev_device *prev)
+ omap3isp_video_cleanup(&prev->video_in);
+ error_video_in:
+ media_entity_cleanup(&prev->subdev.entity);
++error_handler_free:
++ v4l2_ctrl_handler_free(&prev->ctrls);
+ return ret;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From f1b30b08a80b99daddd1ad657bdbc71a84b7909d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 22:19:47 +0200
+Subject: media: s5p-g2d: Fix a memory leak in an error handling path in
+ 'g2d_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 94b9ce6870f9c90ac92505482689818b254312f7 ]
+
+Memory allocated with 'v4l2_m2m_init()' must be freed by a corresponding
+call to 'v4l2_m2m_release()'
+
+Also reorder the code at the end of the probe function so that
+'video_register_device()' is called last.
+Update the error handling path accordingly.
+
+Fixes: 5ce60d790a24 ("[media] s5p-g2d: Add DT based discovery support")
+Fixes: 918847341af0 ("[media] v4l: add G2D driver for s5p device family")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+[hverkuil-cisco@xs4all.nl: checkpatch: align with parenthesis]
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/s5p-g2d/g2d.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
+index 6932fd47071b0..15bcb7f6e113c 100644
+--- a/drivers/media/platform/s5p-g2d/g2d.c
++++ b/drivers/media/platform/s5p-g2d/g2d.c
+@@ -695,21 +695,13 @@ static int g2d_probe(struct platform_device *pdev)
+ vfd->lock = &dev->mutex;
+ vfd->v4l2_dev = &dev->v4l2_dev;
+ vfd->device_caps = V4L2_CAP_VIDEO_M2M | V4L2_CAP_STREAMING;
+- ret = video_register_device(vfd, VFL_TYPE_VIDEO, 0);
+- if (ret) {
+- v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+- goto rel_vdev;
+- }
+- video_set_drvdata(vfd, dev);
+- dev->vfd = vfd;
+- v4l2_info(&dev->v4l2_dev, "device registered as /dev/video%d\n",
+- vfd->num);
++
+ platform_set_drvdata(pdev, dev);
+ dev->m2m_dev = v4l2_m2m_init(&g2d_m2m_ops);
+ if (IS_ERR(dev->m2m_dev)) {
+ v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem device\n");
+ ret = PTR_ERR(dev->m2m_dev);
+- goto unreg_video_dev;
++ goto rel_vdev;
+ }
+
+ def_frame.stride = (def_frame.width * def_frame.fmt->depth) >> 3;
+@@ -717,14 +709,24 @@ static int g2d_probe(struct platform_device *pdev)
+ of_id = of_match_node(exynos_g2d_match, pdev->dev.of_node);
+ if (!of_id) {
+ ret = -ENODEV;
+- goto unreg_video_dev;
++ goto free_m2m;
+ }
+ dev->variant = (struct g2d_variant *)of_id->data;
+
++ ret = video_register_device(vfd, VFL_TYPE_VIDEO, 0);
++ if (ret) {
++ v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
++ goto free_m2m;
++ }
++ video_set_drvdata(vfd, dev);
++ dev->vfd = vfd;
++ v4l2_info(&dev->v4l2_dev, "device registered as /dev/video%d\n",
++ vfd->num);
++
+ return 0;
+
+-unreg_video_dev:
+- video_unregister_device(dev->vfd);
++free_m2m:
++ v4l2_m2m_release(dev->m2m_dev);
+ rel_vdev:
+ video_device_release(vfd);
+ unreg_v4l2_dev:
+--
+2.25.1
+
--- /dev/null
+From 16b96e4ed7dc97b28b95381a4a62858a9d5dc226 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 20:08:01 +0200
+Subject: media: staging: rkisp1: rsz: fix resolution limitation on sink pad
+
+From: Helen Koike <helen.koike@collabora.com>
+
+[ Upstream commit 906dceb48dfa1e7c99c32e6b25878d47023e916b ]
+
+Resizer sink pad is limited by what the ISP can generate.
+The configurations describes what the resizer can produce.
+
+This was tested on a Scarlet device with ChromiumOs, where the selfpath
+receives 2592x1944 and produces 1600x1200 (which isn't possible without
+this fix).
+
+Fixes: 56e3b29f9f6b2 ("media: staging: rkisp1: add streaming paths")
+Signed-off-by: Helen Koike <helen.koike@collabora.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-resizer.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-resizer.c b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+index d64c064bdb1d2..e188944941b58 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-resizer.c
++++ b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+@@ -553,11 +553,11 @@ static void rkisp1_rsz_set_sink_fmt(struct rkisp1_resizer *rsz,
+ src_fmt->code = sink_fmt->code;
+
+ sink_fmt->width = clamp_t(u32, format->width,
+- rsz->config->min_rsz_width,
+- rsz->config->max_rsz_width);
++ RKISP1_ISP_MIN_WIDTH,
++ RKISP1_ISP_MAX_WIDTH);
+ sink_fmt->height = clamp_t(u32, format->height,
+- rsz->config->min_rsz_height,
+- rsz->config->max_rsz_height);
++ RKISP1_ISP_MIN_HEIGHT,
++ RKISP1_ISP_MAX_HEIGHT);
+
+ *format = *sink_fmt;
+
+--
+2.25.1
+
--- /dev/null
+From ba08189fb1465531553f3dfdd89a45366300cd78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 13:35:15 +0200
+Subject: media: staging: rkisp1: rsz: supported formats are the isp's src
+ formats, not sink formats
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit 7b8ce1f2763b9351a4cb04b802835470e76770a5 ]
+
+The rkisp1_resizer's enum callback 'rkisp1_rsz_enum_mbus_code'
+calls the enum callback of the 'rkisp1_isp' on it's video sink pad.
+This is a bug, the resizer should support the same formats
+supported by the 'rkisp1_isp' on the source pad (not the sink pad).
+
+Fixes: 56e3b29f9f6b "media: staging: rkisp1: add streaming paths"
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-resizer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-resizer.c b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+index d049374413dcf..d64c064bdb1d2 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-resizer.c
++++ b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+@@ -437,8 +437,8 @@ static int rkisp1_rsz_enum_mbus_code(struct v4l2_subdev *sd,
+ u32 pad = code->pad;
+ int ret;
+
+- /* supported mbus codes are the same in isp sink pad */
+- code->pad = RKISP1_ISP_PAD_SINK_VIDEO;
++ /* supported mbus codes are the same in isp video src pad */
++ code->pad = RKISP1_ISP_PAD_SOURCE_VIDEO;
+ ret = v4l2_subdev_call(&rsz->rkisp1->isp.sd, pad, enum_mbus_code,
+ &dummy_cfg, code);
+
+--
+2.25.1
+
--- /dev/null
+From aa6746c7d8465d760bf8224245d560b841bb1c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2020 16:39:18 +0200
+Subject: media: tvp5150: Add missed media_entity_cleanup()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit d000e9b5e4a23dd700b3f58a4738c94bb5179ff0 ]
+
+This driver does not call media_entity_cleanup() in the error handler
+of tvp5150_registered() and tvp5150_remove(), while it has called
+media_entity_pads_init() at first.
+Add the missed calls to fix it.
+
+Fixes: 0556f1d580d4 ("media: tvp5150: add input source selection of_graph support")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tvp5150.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index eb39cf5ea0895..9df575238952a 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -1664,8 +1664,10 @@ static int tvp5150_registered(struct v4l2_subdev *sd)
+ return 0;
+
+ err:
+- for (i = 0; i < decoder->connectors_num; i++)
++ for (i = 0; i < decoder->connectors_num; i++) {
+ media_device_unregister_entity(&decoder->connectors[i].ent);
++ media_entity_cleanup(&decoder->connectors[i].ent);
++ }
+ return ret;
+ #endif
+
+@@ -2248,8 +2250,10 @@ static int tvp5150_remove(struct i2c_client *c)
+
+ for (i = 0; i < decoder->connectors_num; i++)
+ v4l2_fwnode_connector_free(&decoder->connectors[i].base);
+- for (i = 0; i < decoder->connectors_num; i++)
++ for (i = 0; i < decoder->connectors_num; i++) {
+ media_device_unregister_entity(&decoder->connectors[i].ent);
++ media_entity_cleanup(&decoder->connectors[i].ent);
++ }
+ v4l2_async_unregister_subdev(sd);
+ v4l2_ctrl_handler_free(&decoder->hdl);
+ pm_runtime_disable(&c->dev);
+--
+2.25.1
+
--- /dev/null
+From 3e0bdac317bf74e6af16835b17ed44d6a9a2a556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 13:03:01 +0200
+Subject: memory: samsung: exynos5422-dmc: Do not ignore return code of
+ regmap_read()
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c4f16e96d8fdd62ef12898fc0965c42093bed237 ]
+
+Check for regmap_read() return code before using the read value in
+following write in exynos5_switch_timing_regs(). Pass reading error
+code to the callers.
+
+This does not introduce proper error handling for such failed reads (and
+obviously regmap_write() error is still ignored) because the driver
+ignored this in all places. Therefor it only fixes reported issue while
+matching current driver coding style:
+
+ drivers/memory/samsung/exynos5422-dmc.c: In function 'exynos5_switch_timing_regs':
+ >> drivers/memory/samsung/exynos5422-dmc.c:216:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable]
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/samsung/exynos5422-dmc.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/memory/samsung/exynos5422-dmc.c b/drivers/memory/samsung/exynos5422-dmc.c
+index 25196d6268e21..85b31d3de57ad 100644
+--- a/drivers/memory/samsung/exynos5422-dmc.c
++++ b/drivers/memory/samsung/exynos5422-dmc.c
+@@ -270,12 +270,14 @@ static int find_target_freq_idx(struct exynos5_dmc *dmc,
+ * This function switches between these banks according to the
+ * currently used clock source.
+ */
+-static void exynos5_switch_timing_regs(struct exynos5_dmc *dmc, bool set)
++static int exynos5_switch_timing_regs(struct exynos5_dmc *dmc, bool set)
+ {
+ unsigned int reg;
+ int ret;
+
+ ret = regmap_read(dmc->clk_regmap, CDREX_LPDDR3PHY_CON3, ®);
++ if (ret)
++ return ret;
+
+ if (set)
+ reg |= EXYNOS5_TIMING_SET_SWI;
+@@ -283,6 +285,8 @@ static void exynos5_switch_timing_regs(struct exynos5_dmc *dmc, bool set)
+ reg &= ~EXYNOS5_TIMING_SET_SWI;
+
+ regmap_write(dmc->clk_regmap, CDREX_LPDDR3PHY_CON3, reg);
++
++ return 0;
+ }
+
+ /**
+@@ -516,7 +520,7 @@ exynos5_dmc_switch_to_bypass_configuration(struct exynos5_dmc *dmc,
+ /*
+ * Delays are long enough, so use them for the new coming clock.
+ */
+- exynos5_switch_timing_regs(dmc, USE_MX_MSPLL_TIMINGS);
++ ret = exynos5_switch_timing_regs(dmc, USE_MX_MSPLL_TIMINGS);
+
+ return ret;
+ }
+@@ -577,7 +581,9 @@ exynos5_dmc_change_freq_and_volt(struct exynos5_dmc *dmc,
+
+ clk_set_rate(dmc->fout_bpll, target_rate);
+
+- exynos5_switch_timing_regs(dmc, USE_BPLL_TIMINGS);
++ ret = exynos5_switch_timing_regs(dmc, USE_BPLL_TIMINGS);
++ if (ret)
++ goto disable_clocks;
+
+ ret = clk_set_parent(dmc->mout_mclk_cdrex, dmc->mout_bpll);
+ if (ret)
+--
+2.25.1
+
--- /dev/null
+From 5d11022316d2a3c98565d11a7df5e3f07a8e2a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 May 2020 22:09:07 +0200
+Subject: memory: tegra: Fix an error handling path in tegra186_emc_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit c3d4eb3bf6ad32466555b31094f33a299444f795 ]
+
+The call to tegra_bpmp_get() must be balanced by a call to
+tegra_bpmp_put() in case of error, as already done in the remove
+function.
+
+Add an error handling path and corresponding goto.
+
+Fixes: 52d15dd23f0b ("memory: tegra: Support DVFS on Tegra186 and later")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/tegra186-emc.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/memory/tegra/tegra186-emc.c b/drivers/memory/tegra/tegra186-emc.c
+index 97f26bc77ad41..c900948881d5b 100644
+--- a/drivers/memory/tegra/tegra186-emc.c
++++ b/drivers/memory/tegra/tegra186-emc.c
+@@ -185,7 +185,7 @@ static int tegra186_emc_probe(struct platform_device *pdev)
+ if (IS_ERR(emc->clk)) {
+ err = PTR_ERR(emc->clk);
+ dev_err(&pdev->dev, "failed to get EMC clock: %d\n", err);
+- return err;
++ goto put_bpmp;
+ }
+
+ platform_set_drvdata(pdev, emc);
+@@ -201,7 +201,7 @@ static int tegra186_emc_probe(struct platform_device *pdev)
+ err = tegra_bpmp_transfer(emc->bpmp, &msg);
+ if (err < 0) {
+ dev_err(&pdev->dev, "failed to EMC DVFS pairs: %d\n", err);
+- return err;
++ goto put_bpmp;
+ }
+
+ emc->debugfs.min_rate = ULONG_MAX;
+@@ -211,8 +211,10 @@ static int tegra186_emc_probe(struct platform_device *pdev)
+
+ emc->dvfs = devm_kmalloc_array(&pdev->dev, emc->num_dvfs,
+ sizeof(*emc->dvfs), GFP_KERNEL);
+- if (!emc->dvfs)
+- return -ENOMEM;
++ if (!emc->dvfs) {
++ err = -ENOMEM;
++ goto put_bpmp;
++ }
+
+ dev_dbg(&pdev->dev, "%u DVFS pairs:\n", emc->num_dvfs);
+
+@@ -237,7 +239,7 @@ static int tegra186_emc_probe(struct platform_device *pdev)
+ "failed to set rate range [%lu-%lu] for %pC\n",
+ emc->debugfs.min_rate, emc->debugfs.max_rate,
+ emc->clk);
+- return err;
++ goto put_bpmp;
+ }
+
+ emc->debugfs.root = debugfs_create_dir("emc", NULL);
+@@ -254,6 +256,10 @@ static int tegra186_emc_probe(struct platform_device *pdev)
+ emc, &tegra186_emc_debug_max_rate_fops);
+
+ return 0;
++
++put_bpmp:
++ tegra_bpmp_put(emc->bpmp);
++ return err;
+ }
+
+ static int tegra186_emc_remove(struct platform_device *pdev)
+--
+2.25.1
+
--- /dev/null
+From 987f217fde79e82cc5df6e848c7ef6cf70688cf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 21:47:18 +0800
+Subject: MIPS: OCTEON: add missing put_device() call in
+ dwc3_octeon_device_init()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit e8b9fc10f2615b9a525fce56981e40b489528355 ]
+
+if of_find_device_by_node() succeed, dwc3_octeon_device_init() doesn't have
+a corresponding put_device(). Thus add put_device() to fix the exception
+handling for this function implementation.
+
+Fixes: 93e502b3c2d4 ("MIPS: OCTEON: Platform support for OCTEON III USB controller")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/octeon-usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c
+index 1fd85c559700c..950e6c6e86297 100644
+--- a/arch/mips/cavium-octeon/octeon-usb.c
++++ b/arch/mips/cavium-octeon/octeon-usb.c
+@@ -518,6 +518,7 @@ static int __init dwc3_octeon_device_init(void)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (res == NULL) {
++ put_device(&pdev->dev);
+ dev_err(&pdev->dev, "No memory resources\n");
+ return -ENXIO;
+ }
+@@ -529,8 +530,10 @@ static int __init dwc3_octeon_device_init(void)
+ * know the difference.
+ */
+ base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(base))
++ if (IS_ERR(base)) {
++ put_device(&pdev->dev);
+ return PTR_ERR(base);
++ }
+
+ mutex_lock(&dwc3_octeon_clocks_mutex);
+ dwc3_octeon_clocks_start(&pdev->dev, (u64)base);
+--
+2.25.1
+
--- /dev/null
+From 418948ba9733c10c4dd6dfcaf825213b1ebb79ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 21:14:15 +0800
+Subject: MIPS: only register FTLBPar exception handler for supported models
+
+From: WANG Xuerui <git@xen0n.name>
+
+[ Upstream commit efd1b4ad3d5178a74387bc5ff69a2d4585f586c6 ]
+
+Previously ExcCode 16 is unconditionally treated as the FTLB parity
+exception (FTLBPar), but in fact its semantic is implementation-
+dependent. Looking at various manuals it seems the FTLBPar exception is
+only present on some recent MIPS Technologies cores, so only register
+the handler on these.
+
+Fixes: 75b5b5e0a262790f ("MIPS: Add support for FTLBs")
+Reviewed-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: WANG Xuerui <git@xen0n.name>
+Cc: Paul Burton <paulburton@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/cpu-features.h | 4 ++++
+ arch/mips/include/asm/cpu.h | 1 +
+ arch/mips/kernel/cpu-probe.c | 13 +++++++++++++
+ arch/mips/kernel/traps.c | 3 ++-
+ 4 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
+index 724dfddcab92d..0b1bc7ed913b2 100644
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -568,6 +568,10 @@
+ # define cpu_has_mac2008_only __opt(MIPS_CPU_MAC_2008_ONLY)
+ #endif
+
++#ifndef cpu_has_ftlbparex
++# define cpu_has_ftlbparex __opt(MIPS_CPU_FTLBPAREX)
++#endif
++
+ #ifdef CONFIG_SMP
+ /*
+ * Some systems share FTLB RAMs between threads within a core (siblings in
+diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h
+index 104a509312b30..3a4773714b296 100644
+--- a/arch/mips/include/asm/cpu.h
++++ b/arch/mips/include/asm/cpu.h
+@@ -425,6 +425,7 @@ enum cpu_type_enum {
+ #define MIPS_CPU_MM_SYSAD BIT_ULL(58) /* CPU supports write-through SysAD Valid merge */
+ #define MIPS_CPU_MM_FULL BIT_ULL(59) /* CPU supports write-through full merge */
+ #define MIPS_CPU_MAC_2008_ONLY BIT_ULL(60) /* CPU Only support MAC2008 Fused multiply-add instruction */
++#define MIPS_CPU_FTLBPAREX BIT_ULL(61) /* CPU has FTLB parity exception */
+
+ /*
+ * CPU ASE encodings
+diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
+index def1659fe2621..3404011eb7cff 100644
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -1827,6 +1827,19 @@ static inline void cpu_probe_mips(struct cpuinfo_mips *c, unsigned int cpu)
+ default:
+ break;
+ }
++
++ /* Recent MIPS cores use the implementation-dependent ExcCode 16 for
++ * cache/FTLB parity exceptions.
++ */
++ switch (__get_cpu_type(c->cputype)) {
++ case CPU_PROAPTIV:
++ case CPU_P5600:
++ case CPU_P6600:
++ case CPU_I6400:
++ case CPU_I6500:
++ c->options |= MIPS_CPU_FTLBPAREX;
++ break;
++ }
+ }
+
+ static inline void cpu_probe_alchemy(struct cpuinfo_mips *c, unsigned int cpu)
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index f655af68176c8..e664d8b43e72b 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -2457,7 +2457,8 @@ void __init trap_init(void)
+ if (cpu_has_fpu && !cpu_has_nofpuex)
+ set_except_vector(EXCCODE_FPE, handle_fpe);
+
+- set_except_vector(MIPS_EXCCODE_TLBPAR, handle_ftlb);
++ if (cpu_has_ftlbparex)
++ set_except_vector(MIPS_EXCCODE_TLBPAR, handle_ftlb);
+
+ if (cpu_has_rixiex) {
+ set_except_vector(EXCCODE_TLBRI, tlb_do_page_fault_0);
+--
+2.25.1
+
--- /dev/null
+From 9f108fb5abb28d35b7bebd5526be0020573a4728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Apr 2020 16:46:10 -0700
+Subject: mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 0a3b3c253a1eb2c7fe7f34086d46660c909abeb3 ]
+
+A large process running on a heavily loaded system can encounter the
+following RCU CPU stall warning:
+
+ rcu: INFO: rcu_sched self-detected stall on CPU
+ rcu: 3-....: (20998 ticks this GP) idle=4ea/1/0x4000000000000002 softirq=556558/556558 fqs=5190
+ (t=21013 jiffies g=1005461 q=132576)
+ NMI backtrace for cpu 3
+ CPU: 3 PID: 501900 Comm: aio-free-ring-w Kdump: loaded Not tainted 5.2.9-108_fbk12_rc3_3858_gb83b75af7909 #1
+ Hardware name: Wiwynn HoneyBadger/PantherPlus, BIOS HBM6.71 02/03/2016
+ Call Trace:
+ <IRQ>
+ dump_stack+0x46/0x60
+ nmi_cpu_backtrace.cold.3+0x13/0x50
+ ? lapic_can_unplug_cpu.cold.27+0x34/0x34
+ nmi_trigger_cpumask_backtrace+0xba/0xca
+ rcu_dump_cpu_stacks+0x99/0xc7
+ rcu_sched_clock_irq.cold.87+0x1aa/0x397
+ ? tick_sched_do_timer+0x60/0x60
+ update_process_times+0x28/0x60
+ tick_sched_timer+0x37/0x70
+ __hrtimer_run_queues+0xfe/0x270
+ hrtimer_interrupt+0xf4/0x210
+ smp_apic_timer_interrupt+0x5e/0x120
+ apic_timer_interrupt+0xf/0x20
+ </IRQ>
+ RIP: 0010:kmem_cache_free+0x223/0x300
+ Code: 88 00 00 00 0f 85 ca 00 00 00 41 8b 55 18 31 f6 f7 da 41 f6 45 0a 02 40 0f 94 c6 83 c6 05 9c 41 5e fa e8 a0 a7 01 00 41 56 9d <49> 8b 47 08 a8 03 0f 85 87 00 00 00 65 48 ff 08 e9 3d fe ff ff 65
+ RSP: 0018:ffffc9000e8e3da8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
+ RAX: 0000000000020000 RBX: ffff88861b9de960 RCX: 0000000000000030
+ RDX: fffffffffffe41e8 RSI: 000060777fe3a100 RDI: 000000000001be18
+ RBP: ffffea00186e7780 R08: ffffffffffffffff R09: ffffffffffffffff
+ R10: ffff88861b9dea28 R11: ffff88887ffde000 R12: ffffffff81230a1f
+ R13: ffff888854684dc0 R14: 0000000000000206 R15: ffff8888547dbc00
+ ? remove_vma+0x4f/0x60
+ remove_vma+0x4f/0x60
+ exit_mmap+0xd6/0x160
+ mmput+0x4a/0x110
+ do_exit+0x278/0xae0
+ ? syscall_trace_enter+0x1d3/0x2b0
+ ? handle_mm_fault+0xaa/0x1c0
+ do_group_exit+0x3a/0xa0
+ __x64_sys_exit_group+0x14/0x20
+ do_syscall_64+0x42/0x100
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+And on a PREEMPT=n kernel, the "while (vma)" loop in exit_mmap() can run
+for a very long time given a large process. This commit therefore adds
+a cond_resched() to this loop, providing RCU any needed quiescent states.
+
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: <linux-mm@kvack.org>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/mmap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 8c7ca737a19b3..dcdab2675a21a 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -3171,6 +3171,7 @@ void exit_mmap(struct mm_struct *mm)
+ if (vma->vm_flags & VM_ACCOUNT)
+ nr_accounted += vma_pages(vma);
+ vma = remove_vma(vma);
++ cond_resched();
+ }
+ vm_unacct_memory(nr_accounted);
+ }
+--
+2.25.1
+
--- /dev/null
+From 2c5ac614750776809b67802d9911f053aea31c27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 15:11:41 +0900
+Subject: mmc: sdhci-cadence: do not use hardware tuning for SD mode
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit adc40a5179df30421a5537bfeb4545100ab97d5e ]
+
+As commit ef6b75671b5f ("mmc: sdhci-cadence: send tune request twice to
+work around errata") stated, this IP has an errata. This commit applies
+the second workaround for the SD mode.
+
+Due to the errata, it is not possible to use the hardware tuning provided
+by SDHCI_HOST_CONTROL2.
+
+Use the software-controlled tuning like the eMMC mode.
+
+Set sdhci_host_ops::platform_execute_tuning instead of overriding
+mmc_host_ops::execute_tuning.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Link: https://lore.kernel.org/r/20200720061141.172944-1-yamada.masahiro@socionext.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-cadence.c | 123 ++++++++++++++++---------------
+ 1 file changed, 62 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c
+index 4a6c9ba825381..4d9f7681817c1 100644
+--- a/drivers/mmc/host/sdhci-cadence.c
++++ b/drivers/mmc/host/sdhci-cadence.c
+@@ -202,57 +202,6 @@ static u32 sdhci_cdns_get_emmc_mode(struct sdhci_cdns_priv *priv)
+ return FIELD_GET(SDHCI_CDNS_HRS06_MODE, tmp);
+ }
+
+-static void sdhci_cdns_set_uhs_signaling(struct sdhci_host *host,
+- unsigned int timing)
+-{
+- struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host);
+- u32 mode;
+-
+- switch (timing) {
+- case MMC_TIMING_MMC_HS:
+- mode = SDHCI_CDNS_HRS06_MODE_MMC_SDR;
+- break;
+- case MMC_TIMING_MMC_DDR52:
+- mode = SDHCI_CDNS_HRS06_MODE_MMC_DDR;
+- break;
+- case MMC_TIMING_MMC_HS200:
+- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS200;
+- break;
+- case MMC_TIMING_MMC_HS400:
+- if (priv->enhanced_strobe)
+- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400ES;
+- else
+- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400;
+- break;
+- default:
+- mode = SDHCI_CDNS_HRS06_MODE_SD;
+- break;
+- }
+-
+- sdhci_cdns_set_emmc_mode(priv, mode);
+-
+- /* For SD, fall back to the default handler */
+- if (mode == SDHCI_CDNS_HRS06_MODE_SD)
+- sdhci_set_uhs_signaling(host, timing);
+-}
+-
+-static const struct sdhci_ops sdhci_cdns_ops = {
+- .set_clock = sdhci_set_clock,
+- .get_timeout_clock = sdhci_cdns_get_timeout_clock,
+- .set_bus_width = sdhci_set_bus_width,
+- .reset = sdhci_reset,
+- .set_uhs_signaling = sdhci_cdns_set_uhs_signaling,
+-};
+-
+-static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = {
+- .ops = &sdhci_cdns_ops,
+- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+-};
+-
+-static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = {
+- .ops = &sdhci_cdns_ops,
+-};
+-
+ static int sdhci_cdns_set_tune_val(struct sdhci_host *host, unsigned int val)
+ {
+ struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host);
+@@ -286,23 +235,24 @@ static int sdhci_cdns_set_tune_val(struct sdhci_host *host, unsigned int val)
+ return 0;
+ }
+
+-static int sdhci_cdns_execute_tuning(struct mmc_host *mmc, u32 opcode)
++/*
++ * In SD mode, software must not use the hardware tuning and instead perform
++ * an almost identical procedure to eMMC.
++ */
++static int sdhci_cdns_execute_tuning(struct sdhci_host *host, u32 opcode)
+ {
+- struct sdhci_host *host = mmc_priv(mmc);
+ int cur_streak = 0;
+ int max_streak = 0;
+ int end_of_streak = 0;
+ int i;
+
+ /*
+- * This handler only implements the eMMC tuning that is specific to
+- * this controller. Fall back to the standard method for SD timing.
++ * Do not execute tuning for UHS_SDR50 or UHS_DDR50.
++ * The delay is set by probe, based on the DT properties.
+ */
+- if (host->timing != MMC_TIMING_MMC_HS200)
+- return sdhci_execute_tuning(mmc, opcode);
+-
+- if (WARN_ON(opcode != MMC_SEND_TUNING_BLOCK_HS200))
+- return -EINVAL;
++ if (host->timing != MMC_TIMING_MMC_HS200 &&
++ host->timing != MMC_TIMING_UHS_SDR104)
++ return 0;
+
+ for (i = 0; i < SDHCI_CDNS_MAX_TUNING_LOOP; i++) {
+ if (sdhci_cdns_set_tune_val(host, i) ||
+@@ -325,6 +275,58 @@ static int sdhci_cdns_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ return sdhci_cdns_set_tune_val(host, end_of_streak - max_streak / 2);
+ }
+
++static void sdhci_cdns_set_uhs_signaling(struct sdhci_host *host,
++ unsigned int timing)
++{
++ struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host);
++ u32 mode;
++
++ switch (timing) {
++ case MMC_TIMING_MMC_HS:
++ mode = SDHCI_CDNS_HRS06_MODE_MMC_SDR;
++ break;
++ case MMC_TIMING_MMC_DDR52:
++ mode = SDHCI_CDNS_HRS06_MODE_MMC_DDR;
++ break;
++ case MMC_TIMING_MMC_HS200:
++ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS200;
++ break;
++ case MMC_TIMING_MMC_HS400:
++ if (priv->enhanced_strobe)
++ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400ES;
++ else
++ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400;
++ break;
++ default:
++ mode = SDHCI_CDNS_HRS06_MODE_SD;
++ break;
++ }
++
++ sdhci_cdns_set_emmc_mode(priv, mode);
++
++ /* For SD, fall back to the default handler */
++ if (mode == SDHCI_CDNS_HRS06_MODE_SD)
++ sdhci_set_uhs_signaling(host, timing);
++}
++
++static const struct sdhci_ops sdhci_cdns_ops = {
++ .set_clock = sdhci_set_clock,
++ .get_timeout_clock = sdhci_cdns_get_timeout_clock,
++ .set_bus_width = sdhci_set_bus_width,
++ .reset = sdhci_reset,
++ .platform_execute_tuning = sdhci_cdns_execute_tuning,
++ .set_uhs_signaling = sdhci_cdns_set_uhs_signaling,
++};
++
++static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = {
++ .ops = &sdhci_cdns_ops,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++};
++
++static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = {
++ .ops = &sdhci_cdns_ops,
++};
++
+ static void sdhci_cdns_hs400_enhanced_strobe(struct mmc_host *mmc,
+ struct mmc_ios *ios)
+ {
+@@ -385,7 +387,6 @@ static int sdhci_cdns_probe(struct platform_device *pdev)
+ priv->hrs_addr = host->ioaddr;
+ priv->enhanced_strobe = false;
+ host->ioaddr += SDHCI_CDNS_SRS_BASE;
+- host->mmc_host_ops.execute_tuning = sdhci_cdns_execute_tuning;
+ host->mmc_host_ops.hs400_enhanced_strobe =
+ sdhci_cdns_hs400_enhanced_strobe;
+ sdhci_enable_v4_mode(host);
+--
+2.25.1
+
--- /dev/null
+From b5de856039ba7e5d0b76f2f45f9a6d951ff9d361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 00:22:26 +0800
+Subject: mmc: sdhci-of-arasan: Add missed checks for devm_clk_register()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit c99e1d0c91ac8d7db3062ea1af315f21295701d7 ]
+
+These functions do not check the return value of devm_clk_register():
+ - sdhci_arasan_register_sdcardclk()
+ - sdhci_arasan_register_sampleclk()
+
+Therefore, add the missed checks to fix them.
+
+Fixes: c390f2110adf1 ("mmc: sdhci-of-arasan: Add ability to export card clock")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20200608162226.3259186-1-hslester96@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-arasan.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
+index db9b544465cda..fb26e743e1fd4 100644
+--- a/drivers/mmc/host/sdhci-of-arasan.c
++++ b/drivers/mmc/host/sdhci-of-arasan.c
+@@ -1299,6 +1299,8 @@ sdhci_arasan_register_sdcardclk(struct sdhci_arasan_data *sdhci_arasan,
+ clk_data->sdcardclk_hw.init = &sdcardclk_init;
+ clk_data->sdcardclk =
+ devm_clk_register(dev, &clk_data->sdcardclk_hw);
++ if (IS_ERR(clk_data->sdcardclk))
++ return PTR_ERR(clk_data->sdcardclk);
+ clk_data->sdcardclk_hw.init = NULL;
+
+ ret = of_clk_add_provider(np, of_clk_src_simple_get,
+@@ -1349,6 +1351,8 @@ sdhci_arasan_register_sampleclk(struct sdhci_arasan_data *sdhci_arasan,
+ clk_data->sampleclk_hw.init = &sampleclk_init;
+ clk_data->sampleclk =
+ devm_clk_register(dev, &clk_data->sampleclk_hw);
++ if (IS_ERR(clk_data->sampleclk))
++ return PTR_ERR(clk_data->sampleclk);
+ clk_data->sampleclk_hw.init = NULL;
+
+ ret = of_clk_add_provider(np, of_clk_src_simple_get,
+--
+2.25.1
+
--- /dev/null
+From 1129888eea7e972d4a5fe923b76754629b12e68e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 18:17:33 -0700
+Subject: mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1
+
+From: shirley her <shirley.her@bayhubtech.com>
+
+[ Upstream commit cdd2b769789ae1a030e1a26f6c37c5833cabcb34 ]
+
+To fix support for the O2 host controller Seabird1, set the quirk
+SDHCI_QUIRK2_PRESET_VALUE_BROKEN and the capability bit MMC_CAP2_NO_SDIO.
+Moreover, assign the ->get_cd() callback.
+
+Signed-off-by: Shirley Her <shirley.her@bayhubtech.com>
+Link: https://lore.kernel.org/r/20200721011733.8416-1-shirley.her@bayhubtech.com
+[Ulf: Updated the commit message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-pci-o2micro.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
+index e2a846885902f..ed3c605fcf0c4 100644
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -561,6 +561,12 @@ static int sdhci_pci_o2_probe_slot(struct sdhci_pci_slot *slot)
+ slot->host->mmc_host_ops.get_cd = sdhci_o2_get_cd;
+ }
+
++ if (chip->pdev->device == PCI_DEVICE_ID_O2_SEABIRD1) {
++ slot->host->mmc_host_ops.get_cd = sdhci_o2_get_cd;
++ host->mmc->caps2 |= MMC_CAP2_NO_SDIO;
++ host->quirks2 |= SDHCI_QUIRK2_PRESET_VALUE_BROKEN;
++ }
++
+ host->mmc_host_ops.execute_tuning = sdhci_o2_execute_tuning;
+
+ if (chip->pdev->device != PCI_DEVICE_ID_O2_FUJIN2)
+--
+2.25.1
+
--- /dev/null
+From db383bb5d3ba7b2daec8b53d202837310137b59a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 10:19:22 +0200
+Subject: mt76: mt7615: fix possible memory leak in mt7615_mcu_wtbl_sta_add
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 2bccc8415883c1cd5ae8836548d9783dbbd84999 ]
+
+Free the second mcu skb if __mt76_mcu_skb_send_msg() fails to transmit
+the first one in mt7615_mcu_wtbl_sta_add().
+
+Fixes: 99c457d902cf9 ("mt76: mt7615: move mt7615_mcu_set_bmc to mt7615_mcu_ops")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+index d8c52ffcf0ecb..cb8c1d80ead92 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+@@ -1209,8 +1209,12 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_dev *dev, struct ieee80211_vif *vif,
+ skb = enable ? wskb : sskb;
+
+ err = __mt76_mcu_skb_send_msg(&dev->mt76, skb, cmd, true);
+- if (err < 0)
++ if (err < 0) {
++ skb = enable ? sskb : wskb;
++ dev_kfree_skb(skb);
++
+ return err;
++ }
+
+ cmd = enable ? MCU_EXT_CMD_STA_REC_UPDATE : MCU_EXT_CMD_WTBL_UPDATE;
+ skb = enable ? sskb : wskb;
+--
+2.25.1
+
--- /dev/null
+From 0698bbc3184eddb63c2933fdb6abfd6eb2792996 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 03:16:48 +0800
+Subject: mt76: mt7615: fix potential memory leak in mcu message handler
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 9248c08c3fc4ef816c82aa49d01123f4746d349f ]
+
+Fix potential memory leak in mcu message handler on error condition.
+
+Fixes: 0e6a29e477f3 ("mt76: mt7615: add support to read temperature from mcu")
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+index 6e869b8c5e266..d8c52ffcf0ecb 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+@@ -180,8 +180,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
+ struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
+ int ret = 0;
+
+- if (seq != rxd->seq)
+- return -EAGAIN;
++ if (seq != rxd->seq) {
++ ret = -EAGAIN;
++ goto out;
++ }
+
+ switch (cmd) {
+ case MCU_CMD_PATCH_SEM_CONTROL:
+@@ -208,6 +210,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
+ default:
+ break;
+ }
++out:
+ dev_kfree_skb(skb);
+
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From 2c93b0d5213f88596ca43816b70a664322f72f82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 03:16:46 +0800
+Subject: mt76: mt7663u: fix memory leak in set key
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 4a850f8dc68b8c4a20333521b31600c9d31ccb5d ]
+
+Fix memory leak in set key.
+
+Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7615/usb.c | 21 ++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
+index 5be6704770ad0..7906e6a71c5b9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
+@@ -166,12 +166,16 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
+
+ lockdep_assert_held(&dev->mt76.mutex);
+
+- if (!sta)
+- return -EINVAL;
++ if (!sta) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ cipher = mt7615_mac_get_cipher(key->cipher);
+- if (cipher == MT_CIPHER_NONE)
+- return -EOPNOTSUPP;
++ if (cipher == MT_CIPHER_NONE) {
++ err = -EOPNOTSUPP;
++ goto out;
++ }
+
+ wcid = &wd->sta->wcid;
+
+@@ -179,19 +183,22 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
+ err = mt7615_mac_wtbl_update_key(dev, wcid, key->key, key->keylen,
+ cipher, key->cmd);
+ if (err < 0)
+- return err;
++ goto out;
+
+ err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, key->keyidx,
+ key->cmd);
+ if (err < 0)
+- return err;
++ goto out;
+
+ if (key->cmd == SET_KEY)
+ wcid->cipher |= BIT(cipher);
+ else
+ wcid->cipher &= ~BIT(cipher);
+
+- return 0;
++out:
++ kfree(key->key);
++
++ return err;
+ }
+
+ void mt7663u_wtbl_work(struct work_struct *work)
+--
+2.25.1
+
--- /dev/null
+From 71d3f9e46f7d92986461a6420acc9e4315e24db3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 03:16:47 +0800
+Subject: mt76: mt7663u: fix potential memory leak in mcu message handler
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit c876039e95559350ee101d4b6f6084d9803f2995 ]
+
+Fix potential memory leak in mcu message handler on error condition.
+
+Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
+index cd709fd617db2..3e66ff98cab81 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
+@@ -34,7 +34,6 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+
+ ret = mt76u_bulk_msg(&dev->mt76, skb->data, skb->len, NULL,
+ 1000, ep);
+- dev_kfree_skb(skb);
+ if (ret < 0)
+ goto out;
+
+@@ -43,6 +42,7 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+
+ out:
+ mutex_unlock(&mdev->mcu.mutex);
++ dev_kfree_skb(skb);
+
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 4781b9f4740a1707c87ec7c2b635a43a7c35ca9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 02:23:33 +0800
+Subject: mt76: mt7915: add missing CONFIG_MAC80211_DEBUGFS
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit a6e29d8ecd3d4eea8748d81d7b577083b4a7c441 ]
+
+Add CONFIG_MAC80211_DEBUGFS to fix a reported warning.
+
+Fixes: ec9742a8f38e ("mt76: mt7915: add .sta_add_debugfs support")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+index 5278bee812f1c..7e48f56b5b08e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+@@ -384,6 +384,7 @@ int mt7915_init_debugfs(struct mt7915_dev *dev)
+ return 0;
+ }
+
++#ifdef CONFIG_MAC80211_DEBUGFS
+ /** per-station debugfs **/
+
+ /* usage: <tx mode> <ldpc> <stbc> <bw> <gi> <nss> <mcs> */
+@@ -461,3 +462,4 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ debugfs_create_file("fixed_rate", 0600, dir, sta, &fops_fixed_rate);
+ debugfs_create_file("stats", 0400, dir, sta, &fops_sta_stats);
+ }
++#endif
+--
+2.25.1
+
--- /dev/null
+From 3cfbd97a0c5563065eecd9e91c3f0628efb63b92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 14:04:35 +0300
+Subject: mt76: mt7915: potential array overflow in mt7915_mcu_tx_rate_report()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit eb744e5df86cf7e377d0acc4e686101b0fd9663a ]
+
+Smatch complains that "wcidx" value comes from the network and thus
+cannot be trusted. In this case, it actually seems to come from the
+firmware. If your wireless firmware is malicious then probably no
+amount of carefulness can protect you.
+
+On the other hand, these days we still try to check the firmware as much
+as possible. Verifying that the index is within bounds will silence a
+static checker warning. And it's harmless and a good exercise in kernel
+hardening. So I suggest that we do add a bounds check.
+
+Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index c8c12c740c1a0..8fb8255650a7e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -505,15 +505,22 @@ static void
+ mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb)
+ {
+ struct mt7915_mcu_ra_info *ra = (struct mt7915_mcu_ra_info *)skb->data;
+- u16 wcidx = le16_to_cpu(ra->wlan_idx);
+- struct mt76_wcid *wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
+- struct mt7915_sta *msta = container_of(wcid, struct mt7915_sta, wcid);
+- struct mt7915_sta_stats *stats = &msta->stats;
+- struct mt76_phy *mphy = &dev->mphy;
+ struct rate_info rate = {}, prob_rate = {};
++ u16 probe = le16_to_cpu(ra->prob_up_rate);
+ u16 attempts = le16_to_cpu(ra->attempts);
+ u16 curr = le16_to_cpu(ra->curr_rate);
+- u16 probe = le16_to_cpu(ra->prob_up_rate);
++ u16 wcidx = le16_to_cpu(ra->wlan_idx);
++ struct mt76_phy *mphy = &dev->mphy;
++ struct mt7915_sta_stats *stats;
++ struct mt7915_sta *msta;
++ struct mt76_wcid *wcid;
++
++ if (wcidx >= MT76_N_WCIDS)
++ return;
++
++ wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
++ msta = container_of(wcid, struct mt7915_sta, wcid);
++ stats = &msta->stats;
+
+ if (msta->wcid.ext_phy && dev->mt76.phy2)
+ mphy = dev->mt76.phy2;
+--
+2.25.1
+
--- /dev/null
+From c3e80324ed0af9a87358dffe2ce52b8e71fbbd38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 17:29:01 -0400
+Subject: mtd: rawnand: brcmnand: Don't default to edu transfer
+
+From: Kamal Dasu <kdasu.kdev@gmail.com>
+
+[ Upstream commit bee3ab8bdd3b13faf08e5b6e0218f59b0a49fcc3 ]
+
+When flash-dma is absent do not default to using flash-edu.
+Make sure flash-edu is enabled before setting EDU transfer
+function.
+
+Fixes: a5d53ad26a8b ("mtd: rawnand: brcmnand: Add support for flash-edu for dma transfers")
+Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20200612212902.21347-2-kdasu.kdev@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index 44068e9eea035..ac934a715a194 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -3023,8 +3023,9 @@ int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
+ if (ret < 0)
+ goto err;
+
+- /* set edu transfer function to call */
+- ctrl->dma_trans = brcmnand_edu_trans;
++ if (has_edu(ctrl))
++ /* set edu transfer function to call */
++ ctrl->dma_trans = brcmnand_edu_trans;
+ }
+
+ /* Disable automatic device ID config, direct addressing */
+--
+2.25.1
+
--- /dev/null
+From 16780d100d28b2aaa74fbeeb25eb4ab0d04f64a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 10:22:26 +0200
+Subject: mwifiex: Fix firmware filename for sd8977 chipset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 47fd3ee25e13cc5add48ba2ed71f7ee964b9c3a4 ]
+
+Firmware for sd8977 chipset is distributed by Marvell package and also as
+part of the linux-firmware repository in filename sdsd8977_combo_v2.bin.
+
+This patch fixes mwifiex driver to load correct firmware file for sd8977.
+
+Fixes: 1a0f547831dce ("mwifiex: add support for sd8977 chipset")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/sdio.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.h b/drivers/net/wireless/marvell/mwifiex/sdio.h
+index 71cd8629b28ef..0cac2296ed53c 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sdio.h
++++ b/drivers/net/wireless/marvell/mwifiex/sdio.h
+@@ -36,7 +36,7 @@
+ #define SD8897_DEFAULT_FW_NAME "mrvl/sd8897_uapsta.bin"
+ #define SD8887_DEFAULT_FW_NAME "mrvl/sd8887_uapsta.bin"
+ #define SD8801_DEFAULT_FW_NAME "mrvl/sd8801_uapsta.bin"
+-#define SD8977_DEFAULT_FW_NAME "mrvl/sd8977_uapsta.bin"
++#define SD8977_DEFAULT_FW_NAME "mrvl/sdsd8977_combo_v2.bin"
+ #define SD8987_DEFAULT_FW_NAME "mrvl/sd8987_uapsta.bin"
+ #define SD8997_DEFAULT_FW_NAME "mrvl/sd8997_uapsta.bin"
+
+--
+2.25.1
+
--- /dev/null
+From a96a7df9a1b9207c2b4e771aa7952b280c30c7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 10:22:27 +0200
+Subject: mwifiex: Fix firmware filename for sd8997 chipset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 2e1fcac52a9ea53e5a13a585d48a29a0fb4a9daf ]
+
+Firmware for sd8997 chipset is distributed by Marvell package and also as
+part of the linux-firmware repository in filename sdsd8997_combo_v4.bin.
+
+This patch fixes mwifiex driver to load correct firmware file for sd8997.
+
+Fixes: 6d85ef00d9dfe ("mwifiex: add support for 8997 chipset")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/sdio.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.h b/drivers/net/wireless/marvell/mwifiex/sdio.h
+index 0cac2296ed53c..8b476b007c5e2 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sdio.h
++++ b/drivers/net/wireless/marvell/mwifiex/sdio.h
+@@ -38,7 +38,7 @@
+ #define SD8801_DEFAULT_FW_NAME "mrvl/sd8801_uapsta.bin"
+ #define SD8977_DEFAULT_FW_NAME "mrvl/sdsd8977_combo_v2.bin"
+ #define SD8987_DEFAULT_FW_NAME "mrvl/sd8987_uapsta.bin"
+-#define SD8997_DEFAULT_FW_NAME "mrvl/sd8997_uapsta.bin"
++#define SD8997_DEFAULT_FW_NAME "mrvl/sdsd8997_combo_v4.bin"
+
+ #define BLOCK_MODE 1
+ #define BYTE_MODE 0
+--
+2.25.1
+
--- /dev/null
+From b4028024870ff6bf7ea02e73dddcf0f5a70a856b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:58:57 +0300
+Subject: mwifiex: Prevent memory corruption handling keys
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e18696786548244914f36ec3c46ac99c53df99c3 ]
+
+The length of the key comes from the network and it's a 16 bit number. It
+needs to be capped to prevent a buffer overflow.
+
+Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200708115857.GA13729@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/marvell/mwifiex/sta_cmdresp.c | 22 +++++++++++++------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+index f21660149f584..962d8bfe6f101 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+@@ -580,6 +580,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,
+ {
+ struct host_cmd_ds_802_11_key_material *key =
+ &resp->params.key_material;
++ int len;
++
++ len = le16_to_cpu(key->key_param_set.key_len);
++ if (len > sizeof(key->key_param_set.key))
++ return -EINVAL;
+
+ if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) {
+ if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) {
+@@ -593,9 +598,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,
+
+ memset(priv->aes_key.key_param_set.key, 0,
+ sizeof(key->key_param_set.key));
+- priv->aes_key.key_param_set.key_len = key->key_param_set.key_len;
+- memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key,
+- le16_to_cpu(priv->aes_key.key_param_set.key_len));
++ priv->aes_key.key_param_set.key_len = cpu_to_le16(len);
++ memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len);
+
+ return 0;
+ }
+@@ -610,9 +614,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ struct host_cmd_ds_command *resp)
+ {
+ struct host_cmd_ds_802_11_key_material_v2 *key_v2;
+- __le16 len;
++ int len;
+
+ key_v2 = &resp->params.key_material_v2;
++
++ len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
++ if (len > WLAN_KEY_LEN_CCMP)
++ return -EINVAL;
++
+ if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
+ if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) {
+ mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n");
+@@ -628,10 +637,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
+ WLAN_KEY_LEN_CCMP);
+ priv->aes_key_v2.key_param_set.key_params.aes.key_len =
+- key_v2->key_param_set.key_params.aes.key_len;
+- len = priv->aes_key_v2.key_param_set.key_params.aes.key_len;
++ cpu_to_le16(len);
+ memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
+- key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len));
++ key_v2->key_param_set.key_params.aes.key, len);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 4aaaeaf4cbac38d124b070355c829a91433b73f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 21:40:31 +0300
+Subject: net: atlantic: MACSec offload statistics checkpatch fix
+
+From: Mark Starovoytov <mstarovoitov@marvell.com>
+
+[ Upstream commit 3a8b44546979cf682324bd2fd61e539f428911b4 ]
+
+This patch fixes a checkpatch warning.
+
+Fixes: aec0f1aac58e ("net: atlantic: MACSec offload statistics implementation")
+
+Signed-off-by: Mark Starovoytov <mstarovoitov@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+index 743d3b13b39d7..bb1fc6052bcf1 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+@@ -123,21 +123,21 @@ static const char aq_macsec_stat_names[][ETH_GSTRING_LEN] = {
+ "MACSec OutUnctrlHitDropRedir",
+ };
+
+-static const char *aq_macsec_txsc_stat_names[] = {
++static const char * const aq_macsec_txsc_stat_names[] = {
+ "MACSecTXSC%d ProtectedPkts",
+ "MACSecTXSC%d EncryptedPkts",
+ "MACSecTXSC%d ProtectedOctets",
+ "MACSecTXSC%d EncryptedOctets",
+ };
+
+-static const char *aq_macsec_txsa_stat_names[] = {
++static const char * const aq_macsec_txsa_stat_names[] = {
+ "MACSecTXSC%dSA%d HitDropRedirect",
+ "MACSecTXSC%dSA%d Protected2Pkts",
+ "MACSecTXSC%dSA%d ProtectedPkts",
+ "MACSecTXSC%dSA%d EncryptedPkts",
+ };
+
+-static const char *aq_macsec_rxsa_stat_names[] = {
++static const char * const aq_macsec_rxsa_stat_names[] = {
+ "MACSecRXSC%dSA%d UntaggedHitPkts",
+ "MACSecRXSC%dSA%d CtrlHitDrpRedir",
+ "MACSecRXSC%dSA%d NotUsingSa",
+--
+2.25.1
+
--- /dev/null
+From bb1869cca11dab10c1660a1c1f4936031896315b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 11:21:20 +1200
+Subject: net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 0f3c66a3c7b4e8b9f654b3c998e9674376a51b0f ]
+
+The MV88E6097 chip does not support configuring jumbo frames. Prior to
+commit 5f4366660d65 only the 6352, 6351, 6165 and 6320 chips configured
+jumbo mode. The refactor accidentally added the function for the 6097.
+Remove the erroneous function pointer assignment.
+
+Fixes: 5f4366660d65 ("net: dsa: mv88e6xxx: Refactor setting of jumbo frames")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index fee16c947c2e8..359043659327e 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3485,7 +3485,6 @@ static const struct mv88e6xxx_ops mv88e6097_ops = {
+ .port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ .port_set_egress_floods = mv88e6352_port_set_egress_floods,
+ .port_set_ether_type = mv88e6351_port_set_ether_type,
+- .port_set_jumbo_size = mv88e6165_port_set_jumbo_size,
+ .port_egress_rate_limiting = mv88e6095_port_egress_rate_limiting,
+ .port_pause_limit = mv88e6097_port_pause_limit,
+ .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
+--
+2.25.1
+
--- /dev/null
+From 27c89626459bdd4da0b835fcfd391e1e0b526e78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 01:34:39 +0200
+Subject: net: dsa: rtl8366: Fix VLAN semantics
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 15ab7906cc9290afb006df1bb1074907fbcc7061 ]
+
+The RTL8366 would not handle adding new members (ports) to
+a VLAN: the code assumed that ->port_vlan_add() was only
+called once for a single port. When intializing the
+switch with .configure_vlan_while_not_filtering set to
+true, the function is called numerous times for adding
+all ports to VLAN1, which was something the code could
+not handle.
+
+Alter rtl8366_set_vlan() to just |= new members and
+untagged flags to 4k and MC VLAN table entries alike.
+This makes it possible to just add new ports to a
+VLAN.
+
+Put in some helpful debug code that can be used to find
+any further bugs here.
+
+Cc: DENG Qingfang <dqfext@gmail.com>
+Cc: Mauri Sandberg <sandberg@mailfence.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/rtl8366.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
+index ac88caca5ad4d..a75dcd6698b8a 100644
+--- a/drivers/net/dsa/rtl8366.c
++++ b/drivers/net/dsa/rtl8366.c
+@@ -43,18 +43,26 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member,
+ int ret;
+ int i;
+
++ dev_dbg(smi->dev,
++ "setting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n",
++ vid, member, untag);
++
+ /* Update the 4K table */
+ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
+ if (ret)
+ return ret;
+
+- vlan4k.member = member;
+- vlan4k.untag = untag;
++ vlan4k.member |= member;
++ vlan4k.untag |= untag;
+ vlan4k.fid = fid;
+ ret = smi->ops->set_vlan_4k(smi, &vlan4k);
+ if (ret)
+ return ret;
+
++ dev_dbg(smi->dev,
++ "resulting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n",
++ vid, vlan4k.member, vlan4k.untag);
++
+ /* Try to find an existing MC entry for this VID */
+ for (i = 0; i < smi->num_vlan_mc; i++) {
+ struct rtl8366_vlan_mc vlanmc;
+@@ -65,11 +73,16 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member,
+
+ if (vid == vlanmc.vid) {
+ /* update the MC entry */
+- vlanmc.member = member;
+- vlanmc.untag = untag;
++ vlanmc.member |= member;
++ vlanmc.untag |= untag;
+ vlanmc.fid = fid;
+
+ ret = smi->ops->set_vlan_mc(smi, i, &vlanmc);
++
++ dev_dbg(smi->dev,
++ "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n",
++ vid, vlanmc.member, vlanmc.untag);
++
+ break;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From f4462ee05490f8accd3a70414ec97e6ce8005f62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 01:34:40 +0200
+Subject: net: dsa: rtl8366: Fix VLAN set-up
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 788abc6d9d278ed6fa1fa94db2098481a04152b7 ]
+
+Alter the rtl8366_vlan_add() to call rtl8366_set_vlan()
+inside the loop that goes over all VIDs since we now
+properly support calling that function more than once.
+Augment the loop to postincrement as this is more
+intuitive.
+
+The loop moved past the last VID but called
+rtl8366_set_vlan() with the port number instead of
+the VID, assuming a 1-to-1 correspondence between
+ports and VIDs. This was also a bug.
+
+Cc: DENG Qingfang <dqfext@gmail.com>
+Cc: Mauri Sandberg <sandberg@mailfence.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/rtl8366.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
+index a75dcd6698b8a..1368816abaed1 100644
+--- a/drivers/net/dsa/rtl8366.c
++++ b/drivers/net/dsa/rtl8366.c
+@@ -397,7 +397,7 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
+ if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+ dev_err(smi->dev, "port is DSA or CPU port\n");
+
+- for (vid = vlan->vid_begin; vid <= vlan->vid_end; ++vid) {
++ for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) {
+ int pvid_val = 0;
+
+ dev_info(smi->dev, "add VLAN %04x\n", vid);
+@@ -420,13 +420,13 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
+ if (ret < 0)
+ return;
+ }
+- }
+
+- ret = rtl8366_set_vlan(smi, port, member, untag, 0);
+- if (ret)
+- dev_err(smi->dev,
+- "failed to set up VLAN %04x",
+- vid);
++ ret = rtl8366_set_vlan(smi, vid, member, untag, 0);
++ if (ret)
++ dev_err(smi->dev,
++ "failed to set up VLAN %04x",
++ vid);
++ }
+ }
+ EXPORT_SYMBOL_GPL(rtl8366_vlan_add);
+
+--
+2.25.1
+
--- /dev/null
+From 0148d91daaec030233ebd534218f9097ce281d8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 19:15:37 +0800
+Subject: net: ethernet: aquantia: Fix wrong return value
+
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+[ Upstream commit 0470a48880f8bc42ce26962b79c7b802c5a695ec ]
+
+In function hw_atl_a0_hw_multicast_list_set(), when an invalid
+request is encountered, a negative error code should be returned.
+
+Fixes: bab6de8fd180b ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions")
+Cc: David VomLehn <vomlehn@texas.net>
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+index a312864969afe..6640fd35b29b2 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -782,7 +782,7 @@ static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self,
+ int err = 0;
+
+ if (count > (HW_ATL_A0_MAC_MAX - HW_ATL_A0_MAC_MIN)) {
+- err = EBADRQC;
++ err = -EBADRQC;
+ goto err_exit;
+ }
+ for (self->aq_nic_cfg->mc_list_count = 0U;
+--
+2.25.1
+
--- /dev/null
+From cb392f7bec1e4bafc4a590e7b50c9f18b4edaf8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 21:17:04 +0300
+Subject: net: ethernet: ti: am65-cpsw-nuss: restore vlan configuration while
+ down/up
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 7bcffde02152dd3cb180f6f3aef27e8586b2a905 ]
+
+The vlan configuration is not restored after interface down/up sequence.
+
+Steps to check:
+ # ip link add link eth0 name eth0.100 type vlan id 100
+ # ifconfig eth0 down
+ # ifconfig eth0 up
+
+This patch fixes it, restoring vlan ALE entries on .ndo_open().
+
+Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 6d778bc3d012f..88832277edd5a 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -223,6 +223,9 @@ static int am65_cpsw_nuss_ndo_slave_add_vid(struct net_device *ndev,
+ u32 port_mask, unreg_mcast = 0;
+ int ret;
+
++ if (!netif_running(ndev) || !vid)
++ return 0;
++
+ ret = pm_runtime_get_sync(common->dev);
+ if (ret < 0) {
+ pm_runtime_put_noidle(common->dev);
+@@ -246,6 +249,9 @@ static int am65_cpsw_nuss_ndo_slave_kill_vid(struct net_device *ndev,
+ struct am65_cpsw_common *common = am65_ndev_to_common(ndev);
+ int ret;
+
++ if (!netif_running(ndev) || !vid)
++ return 0;
++
+ ret = pm_runtime_get_sync(common->dev);
+ if (ret < 0) {
+ pm_runtime_put_noidle(common->dev);
+@@ -571,6 +577,16 @@ static int am65_cpsw_nuss_ndo_slave_stop(struct net_device *ndev)
+ return 0;
+ }
+
++static int cpsw_restore_vlans(struct net_device *vdev, int vid, void *arg)
++{
++ struct am65_cpsw_port *port = arg;
++
++ if (!vdev)
++ return 0;
++
++ return am65_cpsw_nuss_ndo_slave_add_vid(port->ndev, 0, vid);
++}
++
+ static int am65_cpsw_nuss_ndo_slave_open(struct net_device *ndev)
+ {
+ struct am65_cpsw_common *common = am65_ndev_to_common(ndev);
+@@ -644,6 +660,9 @@ static int am65_cpsw_nuss_ndo_slave_open(struct net_device *ndev)
+ }
+ }
+
++ /* restore vlan configurations */
++ vlan_for_each(ndev, cpsw_restore_vlans, port);
++
+ phy_attached_info(port->slave.phy);
+ phy_start(port->slave.phy);
+
+--
+2.25.1
+
--- /dev/null
+From aa84e7bc34e04354faeb1c16b06751cb888bded7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 15:24:19 +0800
+Subject: net: ll_temac: Use devm_platform_ioremap_resource_byname()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit bd69058f50d5ffa659423bcfa6fe6280ce9c760a ]
+
+platform_get_resource() may fail and return NULL, so we had better
+check its return value to avoid a NULL pointer dereference a bit later
+in the code. Fix it to use devm_platform_ioremap_resource_byname()
+instead of calling platform_get_resource_byname() and devm_ioremap().
+
+Fixes: 8425c41d1ef7 ("net: ll_temac: Extend support to non-device-tree platforms")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 929244064abd9..9a15f14daa479 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -1407,10 +1407,8 @@ static int temac_probe(struct platform_device *pdev)
+ }
+
+ /* map device registers */
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- lp->regs = devm_ioremap(&pdev->dev, res->start,
+- resource_size(res));
+- if (!lp->regs) {
++ lp->regs = devm_platform_ioremap_resource_byname(pdev, 0);
++ if (IS_ERR(lp->regs)) {
+ dev_err(&pdev->dev, "could not map TEMAC registers\n");
+ return -ENOMEM;
+ }
+--
+2.25.1
+
--- /dev/null
+From e7719e63e6e8df29e85ea4ef441041ca6ce73063 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 14:17:16 +0200
+Subject: net: macb: Properly handle phylink on at91sam9x
+
+From: Stefan Roese <sr@denx.de>
+
+[ Upstream commit f7ba7dbf4f7af67b5936ff1cbd40a3254b409ebf ]
+
+I just recently noticed that ethernet does not work anymore since v5.5
+on the GARDENA smart Gateway, which is based on the AT91SAM9G25.
+Debugging showed that the "GEM bits" in the NCFGR register are now
+unconditionally accessed, which is incorrect for the !macb_is_gem()
+case.
+
+This patch adds the macb_is_gem() checks back to the code
+(in macb_mac_config() & macb_mac_link_up()), so that the GEM register
+bits are not accessed in this case any more.
+
+Fixes: 7897b071ac3b ("net: macb: convert to phylink")
+Signed-off-by: Stefan Roese <sr@denx.de>
+Cc: Reto Schneider <reto.schneider@husqvarnagroup.com>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 2213e6ab81512..4b1b5928b1043 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -578,7 +578,7 @@ static void macb_mac_config(struct phylink_config *config, unsigned int mode,
+ if (bp->caps & MACB_CAPS_MACB_IS_EMAC) {
+ if (state->interface == PHY_INTERFACE_MODE_RMII)
+ ctrl |= MACB_BIT(RM9200_RMII);
+- } else {
++ } else if (macb_is_gem(bp)) {
+ ctrl &= ~(GEM_BIT(SGMIIEN) | GEM_BIT(PCSSEL));
+
+ if (state->interface == PHY_INTERFACE_MODE_SGMII)
+@@ -639,10 +639,13 @@ static void macb_mac_link_up(struct phylink_config *config,
+ ctrl |= MACB_BIT(FD);
+
+ if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC)) {
+- ctrl &= ~(GEM_BIT(GBE) | MACB_BIT(PAE));
++ ctrl &= ~MACB_BIT(PAE);
++ if (macb_is_gem(bp)) {
++ ctrl &= ~GEM_BIT(GBE);
+
+- if (speed == SPEED_1000)
+- ctrl |= GEM_BIT(GBE);
++ if (speed == SPEED_1000)
++ ctrl |= GEM_BIT(GBE);
++ }
+
+ /* We do not support MLO_PAUSE_RX yet */
+ if (tx_pause)
+--
+2.25.1
+
--- /dev/null
+From d12157f851c40aae26005a8c4eb62b3b7dd59ab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jul 2020 11:04:30 +0300
+Subject: net/mlx5: Delete extra dump stack that gives nothing
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 6c4e9bcfb48933d533ff975e152757991556294a ]
+
+The WARN_*() macros are intended to catch impossible situations
+from the SW point of view. They gave a little in case HW<->SW interface
+is out-of-sync.
+
+Such out-of-sync scenario can be due to SW errors that are not part
+of this flow or because some HW errors, where dump stack won't help
+either.
+
+This specific WARN_ON() is useless because mlx5_core code is prepared
+to handle such situations and will unfold everything correctly while
+providing enough information to the users to understand why FS is not
+working.
+
+WARNING: CPU: 0 PID: 3222 at drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:825 connect_fts_in_prio.isra.20+0x1dd/0x260 linux/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:825
+Kernel panic - not syncing: panic_on_warn set ...
+CPU: 0 PID: 3222 Comm: syz-executor861 Not tainted 5.5.0-rc6+ #2
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+Call Trace:
+ __dump_stack linux/lib/dump_stack.c:77 [inline]
+ dump_stack+0x94/0xce linux/lib/dump_stack.c:118
+ panic+0x234/0x56f linux/kernel/panic.c:221
+ __warn+0x1cc/0x1e1 linux/kernel/panic.c:582
+ report_bug+0x200/0x310 linux/lib/bug.c:195
+ fixup_bug.part.11+0x32/0x80 linux/arch/x86/kernel/traps.c:174
+ fixup_bug linux/arch/x86/kernel/traps.c:273 [inline]
+ do_error_trap+0xd3/0x100 linux/arch/x86/kernel/traps.c:267
+ do_invalid_op+0x31/0x40 linux/arch/x86/kernel/traps.c:286
+ invalid_op+0x1e/0x30 linux/arch/x86/entry/entry_64.S:1027
+RIP: 0010:connect_fts_in_prio.isra.20+0x1dd/0x260
+linux/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:825
+Code: 00 00 48 c7 c2 60 8c 31 84 48 c7 c6 00 81 31 84 48 8b 38 e8 3c a8
+cb ff 41 83 fd 01 8b 04 24 0f 8e 29 ff ff ff e8 83 7b bc fe <0f> 0b 8b
+04 24 e9 1a ff ff ff 89 04 24 e8 c1 20 e0 fe 8b 04 24 eb
+RSP: 0018:ffffc90004bb7858 EFLAGS: 00010293
+RAX: ffff88805de98e80 RBX: 0000000000000c96 RCX: ffffffff827a853d
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: fffff52000976efa
+RBP: 0000000000000007 R08: ffffed100da060e3 R09: ffffed100da060e3
+R10: 0000000000000001 R11: ffffed100da060e2 R12: dffffc0000000000
+R13: 0000000000000002 R14: ffff8880683a1a10 R15: ffffed100d07bc1c
+ connect_prev_fts linux/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:844 [inline]
+ connect_flow_table linux/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:975 [inline]
+ __mlx5_create_flow_table+0x8f8/0x1710 linux/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:1064
+ mlx5_create_flow_table linux/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:1094 [inline]
+ mlx5_create_auto_grouped_flow_table+0xe1/0x210 linux/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c:1136
+ _get_prio linux/drivers/infiniband/hw/mlx5/main.c:3286 [inline]
+ get_flow_table+0x2ea/0x760 linux/drivers/infiniband/hw/mlx5/main.c:3376
+ mlx5_ib_create_flow+0x331/0x11c0 linux/drivers/infiniband/hw/mlx5/main.c:3896
+ ib_uverbs_ex_create_flow+0x13e8/0x1b40 linux/drivers/infiniband/core/uverbs_cmd.c:3311
+ ib_uverbs_write+0xaa5/0xdf0 linux/drivers/infiniband/core/uverbs_main.c:769
+ __vfs_write+0x7c/0x100 linux/fs/read_write.c:494
+ vfs_write+0x168/0x4a0 linux/fs/read_write.c:558
+ ksys_write+0xc8/0x200 linux/fs/read_write.c:611
+ do_syscall_64+0x9c/0x390 linux/arch/x86/entry/common.c:294
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x45a059
+Code: 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89
+f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
+f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007fcc17564c98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+RAX: ffffffffffffffda RBX: 00007fcc17564ca0 RCX: 000000000045a059
+RDX: 0000000000000030 RSI: 00000000200003c0 RDI: 0000000000000005
+RBP: 0000000000000007 R08: 0000000000000002 R09: 0000000000003131
+R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e636c
+R13: 0000000000000000 R14: 00000000006e6360 R15: 00007ffdcbdaf6a0
+Dumping ftrace buffer:
+ (ftrace buffer empty)
+Kernel Offset: disabled
+Rebooting in 1 seconds..
+
+Fixes: f90edfd279f3 ("net/mlx5_core: Connect flow tables")
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Reviewed-by: Mark Bloch <markb@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 2569bb6228b65..2e5f7efb82a88 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -847,18 +847,15 @@ static int connect_fts_in_prio(struct mlx5_core_dev *dev,
+ {
+ struct mlx5_flow_root_namespace *root = find_root(&prio->node);
+ struct mlx5_flow_table *iter;
+- int i = 0;
+ int err;
+
+ fs_for_each_ft(iter, prio) {
+- i++;
+ err = root->cmds->modify_flow_table(root, iter, ft);
+ if (err) {
+- mlx5_core_warn(dev, "Failed to modify flow table %d\n",
+- iter->id);
++ mlx5_core_err(dev,
++ "Failed to modify flow table id %d, type %d, err %d\n",
++ iter->id, iter->type, err);
+ /* The driver is out of sync with the FW */
+- if (i > 1)
+- WARN_ON(true);
+ return err;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 38c7921e26f6fd314e164e8542c8c8c3b8404ae7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 14:09:04 +0300
+Subject: net/mlx5: DR, Change push vlan action sequence
+
+From: Alex Vesker <valex@mellanox.com>
+
+[ Upstream commit b206490940216542c68563699b279eed3c55107c ]
+
+The DR TX state machine supports the following order:
+modify header, push vlan and encapsulation.
+Instead fs_dr would pass:
+push vlan, modify header and encapsulation.
+
+The above caused the rule creation to fail on invalid action
+sequence provided error.
+
+Fixes: 6a48faeeca10 ("net/mlx5: Add direct rule fs_cmd implementation")
+Signed-off-by: Alex Vesker <valex@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/steering/fs_dr.c | 42 +++++++++----------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
+index 8887b2440c7d5..9b08eb557a311 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
+@@ -279,29 +279,9 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns,
+
+ /* The order of the actions are must to be keep, only the following
+ * order is supported by SW steering:
+- * TX: push vlan -> modify header -> encap
++ * TX: modify header -> push vlan -> encap
+ * RX: decap -> pop vlan -> modify header
+ */
+- if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) {
+- tmp_action = create_action_push_vlan(domain, &fte->action.vlan[0]);
+- if (!tmp_action) {
+- err = -ENOMEM;
+- goto free_actions;
+- }
+- fs_dr_actions[fs_dr_num_actions++] = tmp_action;
+- actions[num_actions++] = tmp_action;
+- }
+-
+- if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH_2) {
+- tmp_action = create_action_push_vlan(domain, &fte->action.vlan[1]);
+- if (!tmp_action) {
+- err = -ENOMEM;
+- goto free_actions;
+- }
+- fs_dr_actions[fs_dr_num_actions++] = tmp_action;
+- actions[num_actions++] = tmp_action;
+- }
+-
+ if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_DECAP) {
+ enum mlx5dr_action_reformat_type decap_type =
+ DR_ACTION_REFORMAT_TYP_TNL_L2_TO_L2;
+@@ -354,6 +334,26 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns,
+ actions[num_actions++] =
+ fte->action.modify_hdr->action.dr_action;
+
++ if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) {
++ tmp_action = create_action_push_vlan(domain, &fte->action.vlan[0]);
++ if (!tmp_action) {
++ err = -ENOMEM;
++ goto free_actions;
++ }
++ fs_dr_actions[fs_dr_num_actions++] = tmp_action;
++ actions[num_actions++] = tmp_action;
++ }
++
++ if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH_2) {
++ tmp_action = create_action_push_vlan(domain, &fte->action.vlan[1]);
++ if (!tmp_action) {
++ err = -ENOMEM;
++ goto free_actions;
++ }
++ fs_dr_actions[fs_dr_num_actions++] = tmp_action;
++ actions[num_actions++] = tmp_action;
++ }
++
+ if (delay_encap_set)
+ actions[num_actions++] =
+ fte->action.pkt_reformat->action.dr_action;
+--
+2.25.1
+
--- /dev/null
+From 35106aa58960da2b3514822e97f7f79c4108c6e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jun 2020 14:45:59 +0300
+Subject: net: mscc: ocelot: fix encoding destination ports into multicast IPv4
+ address
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 0897ecf7532577bda3dbcb043ce046a96948889d ]
+
+The ocelot hardware designers have made some hacks to support multicast
+IPv4 and IPv6 addresses. Normally, the MAC table matches on MAC
+addresses and the destination ports are selected through the DEST_IDX
+field of the respective MAC table entry. The DEST_IDX points to a Port
+Group ID (PGID) which contains the bit mask of ports that frames should
+be forwarded to. But there aren't a lot of PGIDs (only 80 or so) and
+there are clearly many more IP multicast addresses than that, so it
+doesn't scale to use this PGID mechanism, so something else was done.
+Since the first portion of the MAC address is known, the hack they did
+was to use a single PGID for _flooding_ unknown IPv4 multicast
+(PGID_MCIPV4 == 62), but for known IP multicast, embed the destination
+ports into the first 3 bytes of the MAC address recorded in the MAC
+table.
+
+The VSC7514 datasheet explains it like this:
+
+ 3.9.1.5 IPv4 Multicast Entries
+
+ MAC table entries with the ENTRY_TYPE = 2 settings are interpreted
+ as IPv4 multicast entries.
+ IPv4 multicasts entries match IPv4 frames, which are classified to
+ the specified VID, and which have DMAC = 0x01005Exxxxxx, where
+ xxxxxx is the lower 24 bits of the MAC address in the entry.
+ Instead of a lookup in the destination mask table (PGID), the
+ destination set is programmed as part of the entry MAC address. This
+ is shown in the following table.
+
+ Table 78: IPv4 Multicast Destination Mask
+
+ Destination Ports Record Bit Field
+ ---------------------------------------------
+ Ports 10-0 MAC[34-24]
+
+ Example: All IPv4 multicast frames in VLAN 12 with MAC 01005E112233 are
+ to be forwarded to ports 3, 8, and 9. This is done by inserting the
+ following entry in the MAC table entry:
+ VALID = 1
+ VID = 12
+ MAC = 0x000308112233
+ ENTRY_TYPE = 2
+ DEST_IDX = 0
+
+But this procedure is not at all what's going on in the driver. In fact,
+the code that embeds the ports into the MAC address looks like it hasn't
+actually been tested. This patch applies the procedure described in the
+datasheet.
+
+Since there are many other fixes to be made around multicast forwarding
+until it works properly, there is no real reason for this patch to be
+backported to stable trees, or considered a real fix of something that
+should have worked.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index f17da67a4622e..d0b79cca51840 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1605,14 +1605,14 @@ static int ocelot_port_obj_add_mdb(struct net_device *dev,
+ addr[0] = 0;
+
+ if (!new) {
+- addr[2] = mc->ports << 0;
+- addr[1] = mc->ports << 8;
++ addr[1] = mc->ports >> 8;
++ addr[2] = mc->ports & 0xff;
+ ocelot_mact_forget(ocelot, addr, vid);
+ }
+
+ mc->ports |= BIT(port);
+- addr[2] = mc->ports << 0;
+- addr[1] = mc->ports << 8;
++ addr[1] = mc->ports >> 8;
++ addr[2] = mc->ports & 0xff;
+
+ return ocelot_mact_learn(ocelot, 0, addr, vid, ENTRYTYPE_MACv4);
+ }
+@@ -1636,9 +1636,9 @@ static int ocelot_port_obj_del_mdb(struct net_device *dev,
+ return -ENOENT;
+
+ memcpy(addr, mc->addr, ETH_ALEN);
+- addr[2] = mc->ports << 0;
+- addr[1] = mc->ports << 8;
+ addr[0] = 0;
++ addr[1] = mc->ports >> 8;
++ addr[2] = mc->ports & 0xff;
+ ocelot_mact_forget(ocelot, addr, vid);
+
+ mc->ports &= ~BIT(port);
+@@ -1648,8 +1648,8 @@ static int ocelot_port_obj_del_mdb(struct net_device *dev,
+ return 0;
+ }
+
+- addr[2] = mc->ports << 0;
+- addr[1] = mc->ports << 8;
++ addr[1] = mc->ports >> 8;
++ addr[2] = mc->ports & 0xff;
+
+ return ocelot_mact_learn(ocelot, 0, addr, vid, ENTRYTYPE_MACv4);
+ }
+--
+2.25.1
+
--- /dev/null
+From 4de147cd1ba1c12544db626af725f230edb3cf51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 10:38:32 +0200
+Subject: net: mvpp2: fix memory leak in mvpp2_rx
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit d6526926de7397a97308780911565e31a6b67b59 ]
+
+Release skb memory in mvpp2_rx() if mvpp2_rx_refill routine fails
+
+Fixes: b5015854674b ("net: mvpp2: fix refilling BM pools in RX path")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Acked-by: Matteo Croce <mcroce@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 24f4d8e0da989..ee72397813d41 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -2981,6 +2981,7 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi,
+ err = mvpp2_rx_refill(port, bm_pool, pool);
+ if (err) {
+ netdev_err(port->dev, "failed to refill BM pools\n");
++ dev_kfree_skb_any(skb);
+ goto err_drop_frame;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 11af46675ff2ee64989ea6fea8cbd5987d7a5ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 17:42:09 +0200
+Subject: net: phy: mscc: restore the base page in vsc8514/8584_config_init
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit 6119dda34e5d0821959e37641b287576826b6378 ]
+
+In the vsc8584_config_init and vsc8514_config_init, the base page is set
+to 'GPIO', configuration is done, and the page is never explicitly
+restored to the standard page. No bug was triggered as it turns out
+helpers called in those config_init functions do modify the base page,
+and set it back to standard. But that is dangerous and any modification
+to those functions would introduce bugs. This patch fixes this, to
+improve maintenance, by restoring the base page to 'standard' once
+'GPIO' accesses are completed.
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc/mscc_main.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c
+index 5ddc44f87eaf0..8f5f2586e7849 100644
+--- a/drivers/net/phy/mscc/mscc_main.c
++++ b/drivers/net/phy/mscc/mscc_main.c
+@@ -1379,6 +1379,11 @@ static int vsc8584_config_init(struct phy_device *phydev)
+ if (ret)
+ goto err;
+
++ ret = phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
++ MSCC_PHY_PAGE_STANDARD);
++ if (ret)
++ goto err;
++
+ if (!phy_interface_is_rgmii(phydev)) {
+ val = PROC_CMD_MCB_ACCESS_MAC_CONF | PROC_CMD_RST_CONF_PORT |
+ PROC_CMD_READ_MOD_WRITE_PORT;
+@@ -1751,7 +1756,11 @@ static int vsc8514_config_init(struct phy_device *phydev)
+ val &= ~MAC_CFG_MASK;
+ val |= MAC_CFG_QSGMII;
+ ret = phy_base_write(phydev, MSCC_PHY_MAC_CFG_FASTLINK, val);
++ if (ret)
++ goto err;
+
++ ret = phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
++ MSCC_PHY_PAGE_STANDARD);
+ if (ret)
+ goto err;
+
+--
+2.25.1
+
--- /dev/null
+From 8b299f7380754048da95f98265294cead1db8018 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 15:52:04 +0200
+Subject: net: sgi: ioc3-eth: Fix the size used in some 'dma_free_coherent()'
+ calls
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit edab74e9cb1d073c70add0f9b75e17aebf0598ff ]
+
+Update the size used in 'dma_free_coherent()' in order to match the one
+used in the corresponding 'dma_alloc_coherent()'.
+
+Fixes: 369a782af0f1 ("net: sgi: ioc3-eth: ensure tx ring is 16k aligned.")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sgi/ioc3-eth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c
+index 6646eba9f57fe..6eef0f45b133b 100644
+--- a/drivers/net/ethernet/sgi/ioc3-eth.c
++++ b/drivers/net/ethernet/sgi/ioc3-eth.c
+@@ -951,7 +951,7 @@ static int ioc3eth_probe(struct platform_device *pdev)
+ dma_free_coherent(ip->dma_dev, RX_RING_SIZE, ip->rxr,
+ ip->rxr_dma);
+ if (ip->tx_ring)
+- dma_free_coherent(ip->dma_dev, TX_RING_SIZE, ip->tx_ring,
++ dma_free_coherent(ip->dma_dev, TX_RING_SIZE + SZ_16K - 1, ip->tx_ring,
+ ip->txr_dma);
+ out_free:
+ free_netdev(dev);
+@@ -964,7 +964,7 @@ static int ioc3eth_remove(struct platform_device *pdev)
+ struct ioc3_private *ip = netdev_priv(dev);
+
+ dma_free_coherent(ip->dma_dev, RX_RING_SIZE, ip->rxr, ip->rxr_dma);
+- dma_free_coherent(ip->dma_dev, TX_RING_SIZE, ip->tx_ring, ip->txr_dma);
++ dma_free_coherent(ip->dma_dev, TX_RING_SIZE + SZ_16K - 1, ip->tx_ring, ip->txr_dma);
+
+ unregister_netdev(dev);
+ del_timer_sync(&ip->ioc3_timer);
+--
+2.25.1
+
--- /dev/null
+From 44585a16812433a87992a7e7271e8a6e94a89cfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 15:53:33 +0200
+Subject: net: spider_net: Fix the size used in a 'dma_free_coherent()' call
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 36f28f7687a9ce665479cce5d64ce7afaa9e77ae ]
+
+Update the size used in 'dma_free_coherent()' in order to match the one
+used in the corresponding 'dma_alloc_coherent()', in
+'spider_net_init_chain()'.
+
+Fixes: d4ed8f8d1fb7 ("Spidernet DMA coalescing")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/toshiba/spider_net.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index 3902b3aeb0c26..94267e1f5d306 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -283,8 +283,8 @@ spider_net_free_chain(struct spider_net_card *card,
+ descr = descr->next;
+ } while (descr != chain->ring);
+
+- dma_free_coherent(&card->pdev->dev, chain->num_desc,
+- chain->hwring, chain->dma_addr);
++ dma_free_coherent(&card->pdev->dev, chain->num_desc * sizeof(struct spider_net_hw_descr),
++ chain->hwring, chain->dma_addr);
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From 545f243447dd020ff72207c9444bf5b002ee2700 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 13:18:48 -0500
+Subject: net: thunderx: initialize VF's mailbox mutex before first usage
+
+From: Dean Nelson <dnelson@redhat.com>
+
+[ Upstream commit c1055b76ad00aed0e8b79417080f212d736246b6 ]
+
+A VF's mailbox mutex is not getting initialized by nicvf_probe() until after
+it is first used. And such usage is resulting in...
+
+[ 28.270927] ------------[ cut here ]------------
+[ 28.270934] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+[ 28.270980] WARNING: CPU: 9 PID: 675 at kernel/locking/mutex.c:938 __mutex_lock+0xdac/0x12f0
+[ 28.270985] Modules linked in: ast(+) nicvf(+) i2c_algo_bit drm_vram_helper drm_ttm_helper ttm nicpf(+) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ixgbe(+) sg thunder_bgx mdio i2c_thunderx mdio_thunder thunder_xcv mdio_cavium dm_mirror dm_region_hash dm_log dm_mod
+[ 28.271064] CPU: 9 PID: 675 Comm: systemd-udevd Not tainted 4.18.0+ #1
+[ 28.271070] Hardware name: GIGABYTE R120-T34-00/MT30-GS2-00, BIOS F02 08/06/2019
+[ 28.271078] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 28.271086] pc : __mutex_lock+0xdac/0x12f0
+[ 28.271092] lr : __mutex_lock+0xdac/0x12f0
+[ 28.271097] sp : ffff800d42146fb0
+[ 28.271103] x29: ffff800d42146fb0 x28: 0000000000000000
+[ 28.271113] x27: ffff800d24361180 x26: dfff200000000000
+[ 28.271122] x25: 0000000000000000 x24: 0000000000000002
+[ 28.271132] x23: ffff20001597cc80 x22: ffff2000139e9848
+[ 28.271141] x21: 0000000000000000 x20: 1ffff001a8428e0c
+[ 28.271151] x19: ffff200015d5d000 x18: 1ffff001ae0f2184
+[ 28.271160] x17: 0000000000000000 x16: 0000000000000000
+[ 28.271170] x15: ffff800d70790c38 x14: ffff20001597c000
+[ 28.271179] x13: ffff20001597cc80 x12: ffff040002b2f779
+[ 28.271189] x11: 1fffe40002b2f778 x10: ffff040002b2f778
+[ 28.271199] x9 : 0000000000000000 x8 : 00000000f1f1f1f1
+[ 28.271208] x7 : 00000000f2f2f2f2 x6 : 0000000000000000
+[ 28.271217] x5 : 1ffff001ae0f2186 x4 : 1fffe400027eb03c
+[ 28.271227] x3 : dfff200000000000 x2 : ffff1001a8428dbe
+[ 28.271237] x1 : c87fdfac7ea11d00 x0 : 0000000000000000
+[ 28.271246] Call trace:
+[ 28.271254] __mutex_lock+0xdac/0x12f0
+[ 28.271261] mutex_lock_nested+0x3c/0x50
+[ 28.271297] nicvf_send_msg_to_pf+0x40/0x3a0 [nicvf]
+[ 28.271316] nicvf_register_misc_interrupt+0x20c/0x328 [nicvf]
+[ 28.271334] nicvf_probe+0x508/0xda0 [nicvf]
+[ 28.271344] local_pci_probe+0xc4/0x180
+[ 28.271352] pci_device_probe+0x3ec/0x528
+[ 28.271363] driver_probe_device+0x21c/0xb98
+[ 28.271371] device_driver_attach+0xe8/0x120
+[ 28.271379] __driver_attach+0xe0/0x2a0
+[ 28.271386] bus_for_each_dev+0x118/0x190
+[ 28.271394] driver_attach+0x48/0x60
+[ 28.271401] bus_add_driver+0x328/0x558
+[ 28.271409] driver_register+0x148/0x398
+[ 28.271416] __pci_register_driver+0x14c/0x1b0
+[ 28.271437] nicvf_init_module+0x54/0x10000 [nicvf]
+[ 28.271447] do_one_initcall+0x18c/0xc18
+[ 28.271457] do_init_module+0x18c/0x618
+[ 28.271464] load_module+0x2bc0/0x4088
+[ 28.271472] __se_sys_finit_module+0x110/0x188
+[ 28.271479] __arm64_sys_finit_module+0x70/0xa0
+[ 28.271490] el0_svc_handler+0x15c/0x380
+[ 28.271496] el0_svc+0x8/0xc
+[ 28.271502] irq event stamp: 52649
+[ 28.271513] hardirqs last enabled at (52649): [<ffff200011b4d790>] _raw_spin_unlock_irqrestore+0xc0/0xd8
+[ 28.271522] hardirqs last disabled at (52648): [<ffff200011b4d3c4>] _raw_spin_lock_irqsave+0x3c/0xf0
+[ 28.271530] softirqs last enabled at (52330): [<ffff200010082af4>] __do_softirq+0xacc/0x117c
+[ 28.271540] softirqs last disabled at (52313): [<ffff20001019b354>] irq_exit+0x3cc/0x500
+[ 28.271545] ---[ end trace a9b90324c8a0d4ee ]---
+
+This problem is resolved by moving the call to mutex_init() up earlier
+in nicvf_probe().
+
+Fixes: 609ea65c65a0 ("net: thunderx: add mutex to protect mailbox from concurrent calls for same VF")
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index a82c708a32278..4fee95584e31a 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -2180,6 +2180,9 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ nic->max_queues *= 2;
+ nic->ptp_clock = ptp_clock;
+
++ /* Initialize mutex that serializes usage of VF's mailbox */
++ mutex_init(&nic->rx_mode_mtx);
++
+ /* MAP VF's configuration registers */
+ nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0);
+ if (!nic->reg_base) {
+@@ -2256,7 +2259,6 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ INIT_WORK(&nic->rx_mode_work.work, nicvf_set_rx_mode_task);
+ spin_lock_init(&nic->rx_mode_wq_lock);
+- mutex_init(&nic->rx_mode_mtx);
+
+ err = register_netdev(netdev);
+ if (err) {
+--
+2.25.1
+
--- /dev/null
+From 0b98a2e21bf9ad72b49e9fd1ceaed9940550ba08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 15:02:30 +0800
+Subject: net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task()
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit bab9693a9a8c6dd19f670408ec1e78e12a320682 ]
+
+A dead lock was triggered on thunderx driver:
+
+ CPU0 CPU1
+ ---- ----
+ [01] lock(&(&nic->rx_mode_wq_lock)->rlock);
+ [11] lock(&(&mc->mca_lock)->rlock);
+ [12] lock(&(&nic->rx_mode_wq_lock)->rlock);
+ [02] <Interrupt> lock(&(&mc->mca_lock)->rlock);
+
+The path for each is:
+
+ [01] worker_thread() -> process_one_work() -> nicvf_set_rx_mode_task()
+ [02] mld_ifc_timer_expire()
+ [11] ipv6_add_dev() -> ipv6_dev_mc_inc() -> igmp6_group_added() ->
+ [12] dev_mc_add() -> __dev_set_rx_mode() -> nicvf_set_rx_mode()
+
+To fix it, it needs to disable bh on [1], so that the timer on [2]
+wouldn't be triggered until rx_mode_wq_lock is released. So change
+to use spin_lock_bh() instead of spin_lock().
+
+Thanks to Paolo for helping with this.
+
+v1->v2:
+ - post to netdev.
+
+Reported-by: Rafael P. <rparrazo@redhat.com>
+Tested-by: Dean Nelson <dnelson@redhat.com>
+Fixes: 469998c861fa ("net: thunderx: prevent concurrent data re-writing by nicvf_set_rx_mode")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index 2ba0ce115e63a..a82c708a32278 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -2042,11 +2042,11 @@ static void nicvf_set_rx_mode_task(struct work_struct *work_arg)
+ /* Save message data locally to prevent them from
+ * being overwritten by next ndo_set_rx_mode call().
+ */
+- spin_lock(&nic->rx_mode_wq_lock);
++ spin_lock_bh(&nic->rx_mode_wq_lock);
+ mode = vf_work->mode;
+ mc = vf_work->mc;
+ vf_work->mc = NULL;
+- spin_unlock(&nic->rx_mode_wq_lock);
++ spin_unlock_bh(&nic->rx_mode_wq_lock);
+
+ __nicvf_set_rx_mode_task(mode, mc, nic);
+ }
+--
+2.25.1
+
--- /dev/null
+From 20f2af466a6558b918147ac7f8ac6b26264a83b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 03:27:03 +0200
+Subject: netfilter: nft_meta: fix iifgroup matching
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 78470d9d0d9f2f8d16f28382a4071568e839c0d5 ]
+
+iifgroup matching erroneously checks the output interface.
+
+Fixes: 8724e819cc9a ("netfilter: nft_meta: move all interface related keys to helper")
+Reported-by: Demi M. Obenour <demiobenour@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_meta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
+index 951b6e87ed5d9..7bc6537f3ccb5 100644
+--- a/net/netfilter/nft_meta.c
++++ b/net/netfilter/nft_meta.c
+@@ -253,7 +253,7 @@ static bool nft_meta_get_eval_ifname(enum nft_meta_keys key, u32 *dest,
+ return false;
+ break;
+ case NFT_META_IIFGROUP:
+- if (!nft_meta_store_ifgroup(dest, nft_out(pkt)))
++ if (!nft_meta_store_ifgroup(dest, nft_in(pkt)))
+ return false;
+ break;
+ case NFT_META_OIFGROUP:
+--
+2.25.1
+
--- /dev/null
+From ba788169a2f38b995d02cc55501f79e6b7809f53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 16:33:07 -0400
+Subject: nfsd: avoid a NULL dereference in __cld_pipe_upcall()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit df60446cd1fb487becd1f36f4c0da9e0e523c0cf ]
+
+If the rpc_pipefs is unmounted, then the rpc_pipe->dentry becomes NULL
+and dereferencing the dentry->d_sb will trigger an oops. The only
+reason we're doing that is to determine the nfsd_net, which could
+instead be passed in by the caller. So do that instead.
+
+Fixes: 11a60d159259 ("nfsd: add a "GetVersion" upcall for nfsdcld")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4recover.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
+index 9e40dfecf1b1a..186fa2c2c6ba6 100644
+--- a/fs/nfsd/nfs4recover.c
++++ b/fs/nfsd/nfs4recover.c
+@@ -747,13 +747,11 @@ struct cld_upcall {
+ };
+
+ static int
+-__cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg)
++__cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn)
+ {
+ int ret;
+ struct rpc_pipe_msg msg;
+ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_u);
+- struct nfsd_net *nn = net_generic(pipe->dentry->d_sb->s_fs_info,
+- nfsd_net_id);
+
+ memset(&msg, 0, sizeof(msg));
+ msg.data = cmsg;
+@@ -773,7 +771,7 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg)
+ }
+
+ static int
+-cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg)
++cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn)
+ {
+ int ret;
+
+@@ -782,7 +780,7 @@ cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg)
+ * upcalls queued.
+ */
+ do {
+- ret = __cld_pipe_upcall(pipe, cmsg);
++ ret = __cld_pipe_upcall(pipe, cmsg, nn);
+ } while (ret == -EAGAIN);
+
+ return ret;
+@@ -1115,7 +1113,7 @@ nfsd4_cld_create(struct nfs4_client *clp)
+ memcpy(cup->cu_u.cu_msg.cm_u.cm_name.cn_id, clp->cl_name.data,
+ clp->cl_name.len);
+
+- ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg);
++ ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg, nn);
+ if (!ret) {
+ ret = cup->cu_u.cu_msg.cm_status;
+ set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
+@@ -1180,7 +1178,7 @@ nfsd4_cld_create_v2(struct nfs4_client *clp)
+ } else
+ cmsg->cm_u.cm_clntinfo.cc_princhash.cp_len = 0;
+
+- ret = cld_pipe_upcall(cn->cn_pipe, cmsg);
++ ret = cld_pipe_upcall(cn->cn_pipe, cmsg, nn);
+ if (!ret) {
+ ret = cmsg->cm_status;
+ set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
+@@ -1218,7 +1216,7 @@ nfsd4_cld_remove(struct nfs4_client *clp)
+ memcpy(cup->cu_u.cu_msg.cm_u.cm_name.cn_id, clp->cl_name.data,
+ clp->cl_name.len);
+
+- ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg);
++ ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg, nn);
+ if (!ret) {
+ ret = cup->cu_u.cu_msg.cm_status;
+ clear_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
+@@ -1261,7 +1259,7 @@ nfsd4_cld_check_v0(struct nfs4_client *clp)
+ memcpy(cup->cu_u.cu_msg.cm_u.cm_name.cn_id, clp->cl_name.data,
+ clp->cl_name.len);
+
+- ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg);
++ ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg, nn);
+ if (!ret) {
+ ret = cup->cu_u.cu_msg.cm_status;
+ set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
+@@ -1404,7 +1402,7 @@ nfsd4_cld_grace_start(struct nfsd_net *nn)
+ }
+
+ cup->cu_u.cu_msg.cm_cmd = Cld_GraceStart;
+- ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg);
++ ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg, nn);
+ if (!ret)
+ ret = cup->cu_u.cu_msg.cm_status;
+
+@@ -1432,7 +1430,7 @@ nfsd4_cld_grace_done_v0(struct nfsd_net *nn)
+
+ cup->cu_u.cu_msg.cm_cmd = Cld_GraceDone;
+ cup->cu_u.cu_msg.cm_u.cm_gracetime = nn->boot_time;
+- ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg);
++ ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg, nn);
+ if (!ret)
+ ret = cup->cu_u.cu_msg.cm_status;
+
+@@ -1460,7 +1458,7 @@ nfsd4_cld_grace_done(struct nfsd_net *nn)
+ }
+
+ cup->cu_u.cu_msg.cm_cmd = Cld_GraceDone;
+- ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg);
++ ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg, nn);
+ if (!ret)
+ ret = cup->cu_u.cu_msg.cm_status;
+
+@@ -1524,7 +1522,7 @@ nfsd4_cld_get_version(struct nfsd_net *nn)
+ goto out_err;
+ }
+ cup->cu_u.cu_msg.cm_cmd = Cld_GetVersion;
+- ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg);
++ ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_u.cu_msg, nn);
+ if (!ret) {
+ ret = cup->cu_u.cu_msg.cm_status;
+ if (ret)
+--
+2.25.1
+
--- /dev/null
+From e837793fad6c168519fcbb9b4d852e247e6cb6e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 18:08:03 +0200
+Subject: nvme-multipath: do not fall back to __nvme_find_path() for
+ non-optimized paths
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit fbd6a42d8932e172921c7de10468a2e12c34846b ]
+
+When nvme_round_robin_path() finds a valid namespace we should be using it;
+falling back to __nvme_find_path() for non-optimized paths will cause the
+result from nvme_round_robin_path() to be ignored for non-optimized paths.
+
+Fixes: 75c10e732724 ("nvme-multipath: round-robin I/O policy")
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index fe8f7f123fac7..57d51148e71b6 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -272,10 +272,13 @@ inline struct nvme_ns *nvme_find_path(struct nvme_ns_head *head)
+ struct nvme_ns *ns;
+
+ ns = srcu_dereference(head->current_path[node], &head->srcu);
+- if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_RR && ns)
+- ns = nvme_round_robin_path(head, node, ns);
+- if (unlikely(!ns || !nvme_path_is_optimized(ns)))
+- ns = __nvme_find_path(head, node);
++ if (unlikely(!ns))
++ return __nvme_find_path(head, node);
++
++ if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_RR)
++ return nvme_round_robin_path(head, node, ns);
++ if (unlikely(!nvme_path_is_optimized(ns)))
++ return __nvme_find_path(head, node);
+ return ns;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From b1a80efbd2d787a9dcc6eca2477cb68a90c154ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 18:08:02 +0200
+Subject: nvme-multipath: fix logic for non-optimized paths
+
+From: Martin Wilck <mwilck@suse.com>
+
+[ Upstream commit 3f6e3246db0e6f92e784965d9d0edb8abe6c6b74 ]
+
+Handle the special case where we have exactly one optimized path,
+which we should keep using in this case.
+
+Fixes: 75c10e732724 ("nvme-multipath: round-robin I/O policy")
+Signed off-by: Martin Wilck <mwilck@suse.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 66509472fe06a..fe8f7f123fac7 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -246,6 +246,12 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head,
+ fallback = ns;
+ }
+
++ /* No optimized path found, re-check the current path */
++ if (!nvme_path_is_disabled(old) &&
++ old->ana_state == NVME_ANA_OPTIMIZED) {
++ found = old;
++ goto out;
++ }
+ if (!fallback)
+ return NULL;
+ found = fallback;
+--
+2.25.1
+
--- /dev/null
+From 99b7a6876eab181da05ad6bed91967f3701c9755 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 17:32:09 -0700
+Subject: nvme-rdma: fix controller reset hang during traffic
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 9f98772ba307dd89a3d17dc2589f213d3972fc64 ]
+
+commit fe35ec58f0d3 ("block: update hctx map when use multiple maps")
+exposed an issue where we may hang trying to wait for queue freeze
+during I/O. We call blk_mq_update_nr_hw_queues which in case of multiple
+queue maps (which we have now for default/read/poll) is attempting to
+freeze the queue. However we never started queue freeze when starting the
+reset, which means that we have inflight pending requests that entered the
+queue that we will not complete once the queue is quiesced.
+
+So start a freeze before we quiesce the queue, and unfreeze the queue
+after we successfully connected the I/O queues (and make sure to call
+blk_mq_update_nr_hw_queues only after we are sure that the queue was
+already frozen).
+
+This follows to how the pci driver handles resets.
+
+Fixes: fe35ec58f0d3 ("block: update hctx map when use multiple maps")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 13506a87a4444..af0cfd25ed7a4 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -941,15 +941,20 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
+ ret = PTR_ERR(ctrl->ctrl.connect_q);
+ goto out_free_tag_set;
+ }
+- } else {
+- blk_mq_update_nr_hw_queues(&ctrl->tag_set,
+- ctrl->ctrl.queue_count - 1);
+ }
+
+ ret = nvme_rdma_start_io_queues(ctrl);
+ if (ret)
+ goto out_cleanup_connect_q;
+
++ if (!new) {
++ nvme_start_queues(&ctrl->ctrl);
++ nvme_wait_freeze(&ctrl->ctrl);
++ blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset,
++ ctrl->ctrl.queue_count - 1);
++ nvme_unfreeze(&ctrl->ctrl);
++ }
++
+ return 0;
+
+ out_cleanup_connect_q:
+@@ -982,6 +987,7 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
+ if (ctrl->ctrl.queue_count > 1) {
++ nvme_start_freeze(&ctrl->ctrl);
+ nvme_stop_queues(&ctrl->ctrl);
+ nvme_rdma_stop_io_queues(ctrl);
+ if (ctrl->ctrl.tagset) {
+--
+2.25.1
+
--- /dev/null
+From 50c291fd6a195a5ab5db2b0be1caa6dac916353d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 15:10:12 -0700
+Subject: nvme-tcp: fix controller reset hang during traffic
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 2875b0aecabe2f081a8432e2bc85b85df0529490 ]
+
+commit fe35ec58f0d3 ("block: update hctx map when use multiple maps")
+exposed an issue where we may hang trying to wait for queue freeze
+during I/O. We call blk_mq_update_nr_hw_queues which in case of multiple
+queue maps (which we have now for default/read/poll) is attempting to
+freeze the queue. However we never started queue freeze when starting the
+reset, which means that we have inflight pending requests that entered the
+queue that we will not complete once the queue is quiesced.
+
+So start a freeze before we quiesce the queue, and unfreeze the queue
+after we successfully connected the I/O queues (and make sure to call
+blk_mq_update_nr_hw_queues only after we are sure that the queue was
+already frozen).
+
+This follows to how the pci driver handles resets.
+
+Fixes: fe35ec58f0d3 ("block: update hctx map when use multiple maps")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index f3a91818167b1..83bb329d4113a 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1744,15 +1744,20 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new)
+ ret = PTR_ERR(ctrl->connect_q);
+ goto out_free_tag_set;
+ }
+- } else {
+- blk_mq_update_nr_hw_queues(ctrl->tagset,
+- ctrl->queue_count - 1);
+ }
+
+ ret = nvme_tcp_start_io_queues(ctrl);
+ if (ret)
+ goto out_cleanup_connect_q;
+
++ if (!new) {
++ nvme_start_queues(ctrl);
++ nvme_wait_freeze(ctrl);
++ blk_mq_update_nr_hw_queues(ctrl->tagset,
++ ctrl->queue_count - 1);
++ nvme_unfreeze(ctrl);
++ }
++
+ return 0;
+
+ out_cleanup_connect_q:
+@@ -1857,6 +1862,7 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
+ {
+ if (ctrl->queue_count <= 1)
+ return;
++ nvme_start_freeze(ctrl);
+ nvme_stop_queues(ctrl);
+ nvme_tcp_stop_io_queues(ctrl);
+ if (ctrl->tagset) {
+--
+2.25.1
+
--- /dev/null
+From bbd092b5ac1bc92599cf8008b9b9c1cfadf36ee0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 11:06:52 +0100
+Subject: nvmem: sprd: Fix return value of sprd_efuse_probe()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit bcd14bb7a68520bf88e45e91d354e43535624f82 ]
+
+When call function devm_platform_ioremap_resource(), we should use IS_ERR()
+to check the return value and return PTR_ERR() if failed.
+
+Fixes: 096030e7f449 ("nvmem: sprd: Add Spreadtrum SoCs eFuse support")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20200722100705.7772-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/sprd-efuse.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvmem/sprd-efuse.c b/drivers/nvmem/sprd-efuse.c
+index 925feb21d5adf..59523245db8a5 100644
+--- a/drivers/nvmem/sprd-efuse.c
++++ b/drivers/nvmem/sprd-efuse.c
+@@ -378,8 +378,8 @@ static int sprd_efuse_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ efuse->base = devm_platform_ioremap_resource(pdev, 0);
+- if (!efuse->base)
+- return -ENOMEM;
++ if (IS_ERR(efuse->base))
++ return PTR_ERR(efuse->base);
+
+ ret = of_hwspin_lock_get_id(np, 0);
+ if (ret < 0) {
+--
+2.25.1
+
--- /dev/null
+From 46f357bdc9035f3963818025b6afbec8b366eab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 23:18:09 -0700
+Subject: ocfs2: fix unbalanced locking
+
+From: Pavel Machek <pavel@ucw.cz>
+
+[ Upstream commit 57c720d4144a9c2b88105c3e8f7b0e97e4b5cc93 ]
+
+Based on what fails, function can return with nfs_sync_rwlock either
+locked or unlocked. That can not be right.
+
+Always return with lock unlocked on error.
+
+Fixes: 4cd9973f9ff6 ("ocfs2: avoid inode removal while nfsd is accessing it")
+Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Link: http://lkml.kernel.org/r/20200724124443.GA28164@duo.ucw.cz
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/dlmglue.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 751bc4dc74663..8e3a369086dbd 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -2871,9 +2871,15 @@ int ocfs2_nfs_sync_lock(struct ocfs2_super *osb, int ex)
+
+ status = ocfs2_cluster_lock(osb, lockres, ex ? LKM_EXMODE : LKM_PRMODE,
+ 0, 0);
+- if (status < 0)
++ if (status < 0) {
+ mlog(ML_ERROR, "lock on nfs sync lock failed %d\n", status);
+
++ if (ex)
++ up_write(&osb->nfs_sync_rwlock);
++ else
++ up_read(&osb->nfs_sync_rwlock);
++ }
++
+ return status;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 3dd3f38a5a623af0a984a7feb65a471b4decdb9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 15:59:25 +0800
+Subject: PCI/ASPM: Add missing newline in sysfs 'policy'
+
+From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+
+[ Upstream commit 3167e3d340c092fd47924bc4d23117a3074ef9a9 ]
+
+When I cat ASPM parameter 'policy' by sysfs, it displays as follows. Add a
+newline for easy reading. Other sysfs attributes already include a
+newline.
+
+ [root@localhost ~]# cat /sys/module/pcie_aspm/parameters/policy
+ [default] performance powersave powersupersave [root@localhost ~]#
+
+Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support")
+Link: https://lore.kernel.org/r/1594972765-10404-1-git-send-email-wangxiongfeng2@huawei.com
+Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aspm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index b17e5ffd31b14..253c30cc19678 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -1182,6 +1182,7 @@ static int pcie_aspm_get_policy(char *buffer, const struct kernel_param *kp)
+ cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]);
+ else
+ cnt += sprintf(buffer + cnt, "%s ", policy_str[i]);
++ cnt += sprintf(buffer + cnt, "\n");
+ return cnt;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From c57cc3a68990a9901861b1d9b3eb3919d376c47f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 16:33:04 +0530
+Subject: PCI: cadence: Fix cdns_pcie_{host|ep}_setup() error path
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 19abcd790b51b26d775e1170ba2ac086823cceeb ]
+
+commit bd22885aa188 ("PCI: cadence: Refactor driver to use as a core
+library") while refactoring the Cadence PCIe driver to be used as
+library, removed pm_runtime_get_sync() from cdns_pcie_ep_setup()
+and cdns_pcie_host_setup() but missed to remove the corresponding
+pm_runtime_put_sync() in the error path. Fix it here.
+
+Link: https://lore.kernel.org/r/20200722110317.4744-3-kishon@ti.com
+Fixes: bd22885aa188 ("PCI: cadence: Refactor driver to use as a core library")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-ep.c | 9 ++-------
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 6 +-----
+ 2 files changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c
+index 1c15c8352125e..4a829ccff7d0b 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-ep.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c
+@@ -8,7 +8,6 @@
+ #include <linux/of.h>
+ #include <linux/pci-epc.h>
+ #include <linux/platform_device.h>
+-#include <linux/pm_runtime.h>
+ #include <linux/sizes.h>
+
+ #include "pcie-cadence.h"
+@@ -440,8 +439,7 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep)
+ epc = devm_pci_epc_create(dev, &cdns_pcie_epc_ops);
+ if (IS_ERR(epc)) {
+ dev_err(dev, "failed to create epc device\n");
+- ret = PTR_ERR(epc);
+- goto err_init;
++ return PTR_ERR(epc);
+ }
+
+ epc_set_drvdata(epc, ep);
+@@ -453,7 +451,7 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep)
+ resource_size(pcie->mem_res), PAGE_SIZE);
+ if (ret < 0) {
+ dev_err(dev, "failed to initialize the memory space\n");
+- goto err_init;
++ return ret;
+ }
+
+ ep->irq_cpu_addr = pci_epc_mem_alloc_addr(epc, &ep->irq_phys_addr,
+@@ -472,8 +470,5 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep)
+ free_epc_mem:
+ pci_epc_mem_exit(epc);
+
+- err_init:
+- pm_runtime_put_sync(dev);
+-
+ return ret;
+ }
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 8c2543f28ba05..a1c6bd6f87c51 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -7,7 +7,6 @@
+ #include <linux/of_address.h>
+ #include <linux/of_pci.h>
+ #include <linux/platform_device.h>
+-#include <linux/pm_runtime.h>
+
+ #include "pcie-cadence.h"
+
+@@ -250,7 +249,7 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+
+ ret = cdns_pcie_host_init(dev, &resources, rc);
+ if (ret)
+- goto err_init;
++ return ret;
+
+ list_splice_init(&resources, &bridge->windows);
+ bridge->dev.parent = dev;
+@@ -268,8 +267,5 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+ err_host_probe:
+ pci_free_resource_list(&resources);
+
+- err_init:
+- pm_runtime_put_sync(dev);
+-
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 59343aaf921fe9e7d9b33f934c4a77537d63d0eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 16:33:11 +0530
+Subject: PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit e3bca37d15dca118f2ef1f0a068bb6e07846ea20 ]
+
+Commit 1b79c5284439 ("PCI: cadence: Add host driver for Cadence PCIe
+controller") in order to update Vendor ID, directly wrote to
+PCI_VENDOR_ID register. However PCI_VENDOR_ID in root port configuration
+space is read-only register and writing to it will have no effect.
+Use local management register to configure Vendor ID and Subsystem Vendor
+ID.
+
+Link: https://lore.kernel.org/r/20200722110317.4744-10-kishon@ti.com
+Fixes: 1b79c5284439 ("PCI: cadence: Add host driver for Cadence PCIe controller")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index a1c6bd6f87c51..b2411e8e6f188 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -69,6 +69,7 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc)
+ {
+ struct cdns_pcie *pcie = &rc->pcie;
+ u32 value, ctrl;
++ u32 id;
+
+ /*
+ * Set the root complex BAR configuration register:
+@@ -88,8 +89,12 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc)
+ cdns_pcie_writel(pcie, CDNS_PCIE_LM_RC_BAR_CFG, value);
+
+ /* Set root port configuration space */
+- if (rc->vendor_id != 0xffff)
+- cdns_pcie_rp_writew(pcie, PCI_VENDOR_ID, rc->vendor_id);
++ if (rc->vendor_id != 0xffff) {
++ id = CDNS_PCIE_LM_ID_VENDOR(rc->vendor_id) |
++ CDNS_PCIE_LM_ID_SUBSYS(rc->vendor_id);
++ cdns_pcie_writel(pcie, CDNS_PCIE_LM_ID, id);
++ }
++
+ if (rc->device_id != 0xffff)
+ cdns_pcie_rp_writew(pcie, PCI_DEVICE_ID, rc->device_id);
+
+--
+2.25.1
+
--- /dev/null
+From dc6cd2deca8e62bd8b46be5f437aea311a687dbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 18:14:55 -0500
+Subject: PCI: Fix pci_cfg_wait queue locking problem
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 2a7e32d0547f41c5ce244f84cf5d6ca7fccee7eb ]
+
+The pci_cfg_wait queue is used to prevent user-space config accesses to
+devices while they are recovering from reset.
+
+Previously we used these operations on pci_cfg_wait:
+
+ __add_wait_queue(&pci_cfg_wait, ...)
+ __remove_wait_queue(&pci_cfg_wait, ...)
+ wake_up_all(&pci_cfg_wait)
+
+The wake_up acquires the wait queue lock, but the add and remove do not.
+
+Originally these were all protected by the pci_lock, but cdcb33f98244
+("PCI: Avoid possible deadlock on pci_lock and p->pi_lock"), moved
+wake_up_all() outside pci_lock, so it could race with add/remove
+operations, which caused occasional kernel panics, e.g., during vfio-pci
+hotplug/unplug testing:
+
+ Unable to handle kernel read from unreadable memory at virtual address ffff802dac469000
+
+Resolve this by using wait_event() instead of __add_wait_queue() and
+__remove_wait_queue(). The wait queue lock is held by both wait_event()
+and wake_up_all(), so it provides mutual exclusion.
+
+Fixes: cdcb33f98244 ("PCI: Avoid possible deadlock on pci_lock and p->pi_lock")
+Link: https://lore.kernel.org/linux-pci/79827f2f-9b43-4411-1376-b9063b67aee3@huawei.com/T/#u
+Based-on: https://lore.kernel.org/linux-pci/20191210031527.40136-1-zhengxiang9@huawei.com/
+Based-on-patch-by: Xiang Zheng <zhengxiang9@huawei.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Xiang Zheng <zhengxiang9@huawei.com>
+Cc: Heyi Guo <guoheyi@huawei.com>
+Cc: Biaoxiang Ye <yebiaoxiang@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/access.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 79c4a2ef269a7..9793f17fa1843 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -204,17 +204,13 @@ EXPORT_SYMBOL(pci_bus_set_ops);
+ static DECLARE_WAIT_QUEUE_HEAD(pci_cfg_wait);
+
+ static noinline void pci_wait_cfg(struct pci_dev *dev)
++ __must_hold(&pci_lock)
+ {
+- DECLARE_WAITQUEUE(wait, current);
+-
+- __add_wait_queue(&pci_cfg_wait, &wait);
+ do {
+- set_current_state(TASK_UNINTERRUPTIBLE);
+ raw_spin_unlock_irq(&pci_lock);
+- schedule();
++ wait_event(pci_cfg_wait, !dev->block_cfg_access);
+ raw_spin_lock_irq(&pci_lock);
+ } while (dev->block_cfg_access);
+- __remove_wait_queue(&pci_cfg_wait, &wait);
+ }
+
+ /* Returns 0 on success, negative values indicate error. */
+--
+2.25.1
+
--- /dev/null
+From 85f69a1777ddc1b0f49608a99e61a6c57a5fa42f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 15:17:31 +0800
+Subject: PCI: hv: Fix a timing issue which causes kdump to fail occasionally
+
+From: Wei Hu <weh@microsoft.com>
+
+[ Upstream commit d6af2ed29c7c1c311b96dac989dcb991e90ee195 ]
+
+Kdump could fail sometime on Hyper-V guest because the retry in
+hv_pci_enter_d0() releases child device structures in hv_pci_bus_exit().
+
+Although there is a second asynchronous device relations message sending
+from the host, if this message arrives to the guest after
+hv_send_resource_allocated() is called, the retry would fail.
+
+Fix the problem by moving retry to hv_pci_probe() and start the retry
+from hv_pci_query_relations() call. This will cause a device relations
+message to arrive to the guest synchronously; the guest would then be
+able to rebuild the child device structures before calling
+hv_send_resource_allocated().
+
+Link: https://lore.kernel.org/r/20200727071731.18516-1-weh@microsoft.com
+Fixes: c81992e7f4aa ("PCI: hv: Retry PCI bus D0 entry on invalid device state")
+Signed-off-by: Wei Hu <weh@microsoft.com>
+[lorenzo.pieralisi@arm.com: fixed a comment and commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-hyperv.c | 71 +++++++++++++++--------------
+ 1 file changed, 37 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index bf40ff09c99d6..d0033ff6c1437 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -2759,10 +2759,8 @@ static int hv_pci_enter_d0(struct hv_device *hdev)
+ struct pci_bus_d0_entry *d0_entry;
+ struct hv_pci_compl comp_pkt;
+ struct pci_packet *pkt;
+- bool retry = true;
+ int ret;
+
+-enter_d0_retry:
+ /*
+ * Tell the host that the bus is ready to use, and moved into the
+ * powered-on state. This includes telling the host which region
+@@ -2789,38 +2787,6 @@ static int hv_pci_enter_d0(struct hv_device *hdev)
+ if (ret)
+ goto exit;
+
+- /*
+- * In certain case (Kdump) the pci device of interest was
+- * not cleanly shut down and resource is still held on host
+- * side, the host could return invalid device status.
+- * We need to explicitly request host to release the resource
+- * and try to enter D0 again.
+- */
+- if (comp_pkt.completion_status < 0 && retry) {
+- retry = false;
+-
+- dev_err(&hdev->device, "Retrying D0 Entry\n");
+-
+- /*
+- * Hv_pci_bus_exit() calls hv_send_resource_released()
+- * to free up resources of its child devices.
+- * In the kdump kernel we need to set the
+- * wslot_res_allocated to 255 so it scans all child
+- * devices to release resources allocated in the
+- * normal kernel before panic happened.
+- */
+- hbus->wslot_res_allocated = 255;
+-
+- ret = hv_pci_bus_exit(hdev, true);
+-
+- if (ret == 0) {
+- kfree(pkt);
+- goto enter_d0_retry;
+- }
+- dev_err(&hdev->device,
+- "Retrying D0 failed with ret %d\n", ret);
+- }
+-
+ if (comp_pkt.completion_status < 0) {
+ dev_err(&hdev->device,
+ "PCI Pass-through VSP failed D0 Entry with status %x\n",
+@@ -3058,6 +3024,7 @@ static int hv_pci_probe(struct hv_device *hdev,
+ struct hv_pcibus_device *hbus;
+ u16 dom_req, dom;
+ char *name;
++ bool enter_d0_retry = true;
+ int ret;
+
+ /*
+@@ -3178,11 +3145,47 @@ static int hv_pci_probe(struct hv_device *hdev,
+ if (ret)
+ goto free_fwnode;
+
++retry:
+ ret = hv_pci_query_relations(hdev);
+ if (ret)
+ goto free_irq_domain;
+
+ ret = hv_pci_enter_d0(hdev);
++ /*
++ * In certain case (Kdump) the pci device of interest was
++ * not cleanly shut down and resource is still held on host
++ * side, the host could return invalid device status.
++ * We need to explicitly request host to release the resource
++ * and try to enter D0 again.
++ * Since the hv_pci_bus_exit() call releases structures
++ * of all its child devices, we need to start the retry from
++ * hv_pci_query_relations() call, requesting host to send
++ * the synchronous child device relations message before this
++ * information is needed in hv_send_resources_allocated()
++ * call later.
++ */
++ if (ret == -EPROTO && enter_d0_retry) {
++ enter_d0_retry = false;
++
++ dev_err(&hdev->device, "Retrying D0 Entry\n");
++
++ /*
++ * Hv_pci_bus_exit() calls hv_send_resources_released()
++ * to free up resources of its child devices.
++ * In the kdump kernel we need to set the
++ * wslot_res_allocated to 255 so it scans all child
++ * devices to release resources allocated in the
++ * normal kernel before panic happened.
++ */
++ hbus->wslot_res_allocated = 255;
++ ret = hv_pci_bus_exit(hdev, true);
++
++ if (ret == 0)
++ goto retry;
++
++ dev_err(&hdev->device,
++ "Retrying D0 failed with ret %d\n", ret);
++ }
+ if (ret)
+ goto free_irq_domain;
+
+--
+2.25.1
+
--- /dev/null
+From de93d21b088bb88d248fc6b59b6380b083ed1221 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jul 2020 17:39:36 +0800
+Subject: PCI: loongson: Use DECLARE_PCI_FIXUP_EARLY for bridge_class_quirk()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 14110af606965ce07abe4d121c100241c2e73b86 ]
+
+According to the datasheet of Loongson LS7A bridge chip, the old version
+of Loongson LS7A PCIE port has a wrong value about PCI class which is
+0x060000, the correct value should be 0x060400, this bug can be fixed by
+"dev->class = PCI_CLASS_BRIDGE_PCI << 8;" at the software level and it
+was fixed in hardware in the latest LS7A versions.
+
+In order to maintain downward compatibility, use DECLARE_PCI_FIXUP_EARLY
+instead of DECLARE_PCI_FIXUP_HEADER for bridge_class_quirk() to fix it as
+early as possible.
+
+Otherwise, in the function pci_setup_device(), the related code about
+"dev->class" such as "class = dev->class >> 8;" and "dev->transparent
+= ((dev->class & 0xff) == 1);" maybe get wrong value without EARLY fixup.
+
+Link: https://lore.kernel.org/r/1595065176-460-1-git-send-email-yangtiezhu@loongson.cn
+Fixes: 1f58cca5cf2b ("PCI: Add Loongson PCI Controller support")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-loongson.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-loongson.c b/drivers/pci/controller/pci-loongson.c
+index 459009c8a4a02..58b862aaa6e94 100644
+--- a/drivers/pci/controller/pci-loongson.c
++++ b/drivers/pci/controller/pci-loongson.c
+@@ -37,11 +37,11 @@ static void bridge_class_quirk(struct pci_dev *dev)
+ {
+ dev->class = PCI_CLASS_BRIDGE_PCI << 8;
+ }
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_LOONGSON,
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON,
+ DEV_PCIE_PORT_0, bridge_class_quirk);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_LOONGSON,
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON,
+ DEV_PCIE_PORT_1, bridge_class_quirk);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_LOONGSON,
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON,
+ DEV_PCIE_PORT_2, bridge_class_quirk);
+
+ static void system_bus_quirk(struct pci_dev *pdev)
+--
+2.25.1
+
--- /dev/null
+From f45580bcdb45710912ac54671a1e2535d7db9be1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 14:43:56 +0800
+Subject: PCI: rcar: Fix runtime PM imbalance on error
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a68e06e729b1b06c50ee52917d6b825b43e7d269 ]
+
+pm_runtime_get_sync() increments the runtime PM usage counter even
+when the call returns an error code. Thus a corresponding decrement is
+needed on the error handling path to keep the counter balanced.
+
+Link: https://lore.kernel.org/r/20200709064356.8800-1-dinghao.liu@zju.edu.cn
+Fixes: 0df6150e7ceb ("PCI: rcar: Use runtime PM to control controller clock")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rcar-host.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
+index d210a36561be2..060c24f5221e2 100644
+--- a/drivers/pci/controller/pcie-rcar-host.c
++++ b/drivers/pci/controller/pcie-rcar-host.c
+@@ -986,7 +986,7 @@ static int rcar_pcie_probe(struct platform_device *pdev)
+ err = pm_runtime_get_sync(pcie->dev);
+ if (err < 0) {
+ dev_err(pcie->dev, "pm_runtime_get_sync failed\n");
+- goto err_pm_disable;
++ goto err_pm_put;
+ }
+
+ err = rcar_pcie_get_resources(host);
+@@ -1057,8 +1057,6 @@ static int rcar_pcie_probe(struct platform_device *pdev)
+
+ err_pm_put:
+ pm_runtime_put(dev);
+-
+-err_pm_disable:
+ pm_runtime_disable(dev);
+ pci_free_resource_list(&host->resources);
+
+--
+2.25.1
+
--- /dev/null
+From 1b5fa8d94f7fc8bbcfb9ac041e59ef73d1ae2bcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 17:44:28 +0800
+Subject: PCI: Release IVRS table in AMD ACS quirk
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 090688fa4e448284aaa16136372397d7d10814db ]
+
+The acpi_get_table() should be coupled with acpi_put_table() if the mapped
+table is not used at runtime to release the table mapping.
+
+In pci_quirk_amd_sb_acs(), IVRS table is just used for checking AMD IOMMU
+is supported, not used at runtime, so put the table after using it.
+
+Fixes: 15b100dfd1c9 ("PCI: Claim ACS support for AMD southbridge devices")
+Link: https://lore.kernel.org/r/1595411068-15440-1-git-send-email-guohanjun@huawei.com
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 2ea61abd58302..d442219cd2708 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4422,6 +4422,8 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags)
+ if (ACPI_FAILURE(status))
+ return -ENODEV;
+
++ acpi_put_table(header);
++
+ /* Filter out flags not applicable to multifunction */
+ acs_flags &= (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_EC | PCI_ACS_DT);
+
+--
+2.25.1
+
--- /dev/null
+From d8a8daa689a14cab589544d7eddd1e550fb4de33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 08:19:27 -0700
+Subject: perf/x86/intel/uncore: Fix oops when counting IMC uncore events on
+ some TGL
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 2af834f1faab3f1e218fcbcab70a399121620d62 ]
+
+When counting IMC uncore events on some TGL machines, an oops will be
+triggered.
+ [ 393.101262] BUG: unable to handle page fault for address:
+ ffffb45200e15858
+ [ 393.101269] #PF: supervisor read access in kernel mode
+ [ 393.101271] #PF: error_code(0x0000) - not-present page
+
+Current perf uncore driver still use the IMC MAP SIZE inherited from
+SNB, which is 0x6000.
+However, the offset of IMC uncore counters is larger than 0x6000,
+e.g. 0xd8a0.
+
+Enlarge the IMC MAP SIZE for TGL to 0xe000.
+
+Fixes: fdb64822443e ("perf/x86: Add Intel Tiger Lake uncore support")
+Reported-by: Ammy Yi <ammy.yi@intel.com>
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Ammy Yi <ammy.yi@intel.com>
+Tested-by: Chao Qin <chao.qin@intel.com>
+Link: https://lkml.kernel.org/r/1590679169-61823-1-git-send-email-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/uncore_snb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
+index 3de1065eefc44..1038e9f1e3542 100644
+--- a/arch/x86/events/intel/uncore_snb.c
++++ b/arch/x86/events/intel/uncore_snb.c
+@@ -1085,6 +1085,7 @@ static struct pci_dev *tgl_uncore_get_mc_dev(void)
+ }
+
+ #define TGL_UNCORE_MMIO_IMC_MEM_OFFSET 0x10000
++#define TGL_UNCORE_PCI_IMC_MAP_SIZE 0xe000
+
+ static void tgl_uncore_imc_freerunning_init_box(struct intel_uncore_box *box)
+ {
+@@ -1112,7 +1113,7 @@ static void tgl_uncore_imc_freerunning_init_box(struct intel_uncore_box *box)
+ addr |= ((resource_size_t)mch_bar << 32);
+ #endif
+
+- box->io_addr = ioremap(addr, SNB_UNCORE_PCI_IMC_MAP_SIZE);
++ box->io_addr = ioremap(addr, TGL_UNCORE_PCI_IMC_MAP_SIZE);
+ }
+
+ static struct intel_uncore_ops tgl_uncore_imc_freerunning_ops = {
+--
+2.25.1
+
--- /dev/null
+From 263c9c5780613a8c01a62ac230c5bfe9197cc624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 15:40:43 +0100
+Subject: phy: armada-38x: fix NETA lockup when repeatedly switching speeds
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 1dea06cd643da38931382ebdc151efced201ffad ]
+
+The mvneta hardware appears to lock up in various random ways when
+repeatedly switching speeds between 1G and 2.5G, which involves
+reprogramming the COMPHY. It is not entirely clear why this happens,
+but best guess is that reprogramming the COMPHY glitches mvneta clocks
+causing the hardware to fail. It seems that rebooting resolves the
+failure, but not down/up cycling the interface alone.
+
+Various other approaches have been tried, such as trying to cleanly
+power down the COMPHY and then take it back through the power up
+initialisation, but this does not seem to help.
+
+It was finally noticed that u-boot's last step when configuring a
+COMPHY for "SGMII" mode was to poke at a register described as
+"GBE_CONFIGURATION_REG", which is undocumented in any external
+documentation. All that we have is the fact that u-boot sets a bit
+corresponding to the "SGMII" lane at the end of COMPHY initialisation.
+
+Experimentation shows that if we clear this bit prior to changing the
+speed, and then set it afterwards, mvneta does not suffer this problem
+on the SolidRun Clearfog when switching speeds between 1G and 2.5G.
+
+This problem was found while script-testing phylink.
+
+This fix also requires the corresponding change to DT to be effective.
+See "ARM: dts: armada-38x: fix NETA lockup when repeatedly switching
+speeds".
+
+Fixes: 14dc100b4411 ("phy: armada38x: add common phy support")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/E1jxtRj-0003Tz-CG@rmk-PC.armlinux.org.uk
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/marvell/phy-armada38x-comphy.c | 45 ++++++++++++++++++----
+ 1 file changed, 38 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/phy/marvell/phy-armada38x-comphy.c b/drivers/phy/marvell/phy-armada38x-comphy.c
+index 6960dfd8ad8c9..0fe4089643342 100644
+--- a/drivers/phy/marvell/phy-armada38x-comphy.c
++++ b/drivers/phy/marvell/phy-armada38x-comphy.c
+@@ -41,6 +41,7 @@ struct a38x_comphy_lane {
+
+ struct a38x_comphy {
+ void __iomem *base;
++ void __iomem *conf;
+ struct device *dev;
+ struct a38x_comphy_lane lane[MAX_A38X_COMPHY];
+ };
+@@ -54,6 +55,21 @@ static const u8 gbe_mux[MAX_A38X_COMPHY][MAX_A38X_PORTS] = {
+ { 0, 0, 3 },
+ };
+
++static void a38x_set_conf(struct a38x_comphy_lane *lane, bool enable)
++{
++ struct a38x_comphy *priv = lane->priv;
++ u32 conf;
++
++ if (priv->conf) {
++ conf = readl_relaxed(priv->conf);
++ if (enable)
++ conf |= BIT(lane->port);
++ else
++ conf &= ~BIT(lane->port);
++ writel(conf, priv->conf);
++ }
++}
++
+ static void a38x_comphy_set_reg(struct a38x_comphy_lane *lane,
+ unsigned int offset, u32 mask, u32 value)
+ {
+@@ -97,6 +113,7 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub)
+ {
+ struct a38x_comphy_lane *lane = phy_get_drvdata(phy);
+ unsigned int gen;
++ int ret;
+
+ if (mode != PHY_MODE_ETHERNET)
+ return -EINVAL;
+@@ -115,13 +132,20 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub)
+ return -EINVAL;
+ }
+
++ a38x_set_conf(lane, false);
++
+ a38x_comphy_set_speed(lane, gen, gen);
+
+- return a38x_comphy_poll(lane, COMPHY_STAT1,
+- COMPHY_STAT1_PLL_RDY_TX |
+- COMPHY_STAT1_PLL_RDY_RX,
+- COMPHY_STAT1_PLL_RDY_TX |
+- COMPHY_STAT1_PLL_RDY_RX);
++ ret = a38x_comphy_poll(lane, COMPHY_STAT1,
++ COMPHY_STAT1_PLL_RDY_TX |
++ COMPHY_STAT1_PLL_RDY_RX,
++ COMPHY_STAT1_PLL_RDY_TX |
++ COMPHY_STAT1_PLL_RDY_RX);
++
++ if (ret == 0)
++ a38x_set_conf(lane, true);
++
++ return ret;
+ }
+
+ static const struct phy_ops a38x_comphy_ops = {
+@@ -174,14 +198,21 @@ static int a38x_comphy_probe(struct platform_device *pdev)
+ if (!priv)
+ return -ENOMEM;
+
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- base = devm_ioremap_resource(&pdev->dev, res);
++ base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
+ priv->dev = &pdev->dev;
+ priv->base = base;
+
++ /* Optional */
++ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "conf");
++ if (res) {
++ priv->conf = devm_ioremap_resource(&pdev->dev, res);
++ if (IS_ERR(priv->conf))
++ return PTR_ERR(priv->conf);
++ }
++
+ for_each_available_child_of_node(pdev->dev.of_node, child) {
+ struct phy *phy;
+ int ret;
+--
+2.25.1
+
--- /dev/null
+From 0d24a90b9e1a7d2c94e4537ddb74061f6e227311 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 14:46:00 +0800
+Subject: phy: cadence: salvo: fix wrong bit definition
+
+From: Peter Chen <peter.chen@nxp.com>
+
+[ Upstream commit 270ff6048f45759d31a7b62d3983b084153837f5 ]
+
+It fixes RX detect wakeup using USB3 device, otherwise, the USB3
+device can't wakeup USB PHY when the PHY is in 32Khz clock.
+
+Fixes: 50d35aa8c15f ("phy: cadence: salvo: add salvo phy driver")
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20200703064600.14181-1-peter.chen@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/phy-cadence-salvo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/phy-cadence-salvo.c b/drivers/phy/cadence/phy-cadence-salvo.c
+index 1ecbb964cd216..016514e4aa549 100644
+--- a/drivers/phy/cadence/phy-cadence-salvo.c
++++ b/drivers/phy/cadence/phy-cadence-salvo.c
+@@ -88,7 +88,7 @@
+ #define TB_ADDR_TX_RCVDETSC_CTRL 0x4124
+
+ /* TB_ADDR_TX_RCVDETSC_CTRL */
+-#define RXDET_IN_P3_32KHZ BIT(1)
++#define RXDET_IN_P3_32KHZ BIT(0)
+
+ struct cdns_reg_pairs {
+ u16 val;
+--
+2.25.1
+
--- /dev/null
+From 785c9690a03ad167975f251e775cd6c0e197a16d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 15:38:00 +0200
+Subject: phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit dcbabfeb17c3c2fdb6bc92a3031ecd37df1834a8 ]
+
+PHY calibration is needed only for USB2.0 (UTMI) PHY, so skip calling
+calibration code when phy_calibrate() is called for USB3.0 (PIPE3) PHY.
+
+Fixes: d8c80bb3b55b ("phy: exynos5-usbdrd: Calibrate LOS levels for exynos5420/5800")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200708133800.3336-1-m.szyprowski@samsung.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/samsung/phy-exynos5-usbdrd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/samsung/phy-exynos5-usbdrd.c b/drivers/phy/samsung/phy-exynos5-usbdrd.c
+index e510732afb8b0..7f6279fb4f8fa 100644
+--- a/drivers/phy/samsung/phy-exynos5-usbdrd.c
++++ b/drivers/phy/samsung/phy-exynos5-usbdrd.c
+@@ -714,7 +714,9 @@ static int exynos5_usbdrd_phy_calibrate(struct phy *phy)
+ struct phy_usb_instance *inst = phy_get_drvdata(phy);
+ struct exynos5_usbdrd_phy *phy_drd = to_usbdrd_phy(inst);
+
+- return exynos5420_usbdrd_phy_calibrate(phy_drd);
++ if (inst->phy_cfg->id == EXYNOS5_DRDPHY_UTMI)
++ return exynos5420_usbdrd_phy_calibrate(phy_drd);
++ return 0;
+ }
+
+ static const struct phy_ops exynos5_usbdrd_phy_ops = {
+--
+2.25.1
+
--- /dev/null
+From 8f5f649ec0e7a4fa4a6cd04132ba61be6bfb53ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 20:44:56 +0900
+Subject: phy: renesas: rcar-gen3-usb2: move irq registration to init
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 08b0ad375ca66181faee725b1b358bcae8d592ee ]
+
+If CONFIG_DEBUG_SHIRQ was enabled, r8a77951-salvator-xs could boot
+correctly. If we appended "earlycon keep_bootcon" to the kernel
+command like, we could get kernel log like below.
+
+ SError Interrupt on CPU0, code 0xbf000002 -- SError
+ CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.8.0-rc3-salvator-x-00505-g6c843129e6faaf01 #785
+ Hardware name: Renesas Salvator-X 2nd version board based on r8a77951 (DT)
+ pstate: 60400085 (nZCv daIf +PAN -UAO BTYPE=--)
+ pc : rcar_gen3_phy_usb2_irq+0x14/0x54
+ lr : free_irq+0xf4/0x27c
+
+This means free_irq() calls the interrupt handler while PM runtime
+is not getting if DEBUG_SHIRQ is enabled and rcar_gen3_phy_usb2_probe()
+failed. To fix the issue, move the irq registration place to
+rcar_gen3_phy_usb2_init() which is ready to handle the interrupts.
+
+Note that after the commit 549b6b55b005 ("phy: renesas: rcar-gen3-usb2:
+enable/disable independent irqs") which is merged into v5.2, since this
+driver creates multiple phy instances, needs to check whether one of
+phy instances is initialized. However, if we backport this patch to v5.1
+or less, we don't need to check it because such kernel have single
+phy instance.
+
+Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Fixes: 9f391c574efc ("phy: rcar-gen3-usb2: add runtime ID/VBUS pin detection")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1594986297-12434-2-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 61 +++++++++++++-----------
+ 1 file changed, 33 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index bfb22f868857f..5087b7c44d55b 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -111,6 +111,7 @@ struct rcar_gen3_chan {
+ struct work_struct work;
+ struct mutex lock; /* protects rphys[...].powered */
+ enum usb_dr_mode dr_mode;
++ int irq;
+ bool extcon_host;
+ bool is_otg_channel;
+ bool uses_otg_pins;
+@@ -389,12 +390,38 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
+ rcar_gen3_device_recognition(ch);
+ }
+
++static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch)
++{
++ struct rcar_gen3_chan *ch = _ch;
++ void __iomem *usb2_base = ch->base;
++ u32 status = readl(usb2_base + USB2_OBINTSTA);
++ irqreturn_t ret = IRQ_NONE;
++
++ if (status & USB2_OBINT_BITS) {
++ dev_vdbg(ch->dev, "%s: %08x\n", __func__, status);
++ writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA);
++ rcar_gen3_device_recognition(ch);
++ ret = IRQ_HANDLED;
++ }
++
++ return ret;
++}
++
+ static int rcar_gen3_phy_usb2_init(struct phy *p)
+ {
+ struct rcar_gen3_phy *rphy = phy_get_drvdata(p);
+ struct rcar_gen3_chan *channel = rphy->ch;
+ void __iomem *usb2_base = channel->base;
+ u32 val;
++ int ret;
++
++ if (!rcar_gen3_is_any_rphy_initialized(channel) && channel->irq >= 0) {
++ INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work);
++ ret = request_irq(channel->irq, rcar_gen3_phy_usb2_irq,
++ IRQF_SHARED, dev_name(channel->dev), channel);
++ if (ret < 0)
++ dev_err(channel->dev, "No irq handler (%d)\n", channel->irq);
++ }
+
+ /* Initialize USB2 part */
+ val = readl(usb2_base + USB2_INT_ENABLE);
+@@ -433,6 +460,9 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p)
+ val &= ~USB2_INT_ENABLE_UCOM_INTEN;
+ writel(val, usb2_base + USB2_INT_ENABLE);
+
++ if (channel->irq >= 0 && !rcar_gen3_is_any_rphy_initialized(channel))
++ free_irq(channel->irq, channel);
++
+ return 0;
+ }
+
+@@ -503,23 +533,6 @@ static const struct phy_ops rz_g1c_phy_usb2_ops = {
+ .owner = THIS_MODULE,
+ };
+
+-static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch)
+-{
+- struct rcar_gen3_chan *ch = _ch;
+- void __iomem *usb2_base = ch->base;
+- u32 status = readl(usb2_base + USB2_OBINTSTA);
+- irqreturn_t ret = IRQ_NONE;
+-
+- if (status & USB2_OBINT_BITS) {
+- dev_vdbg(ch->dev, "%s: %08x\n", __func__, status);
+- writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA);
+- rcar_gen3_device_recognition(ch);
+- ret = IRQ_HANDLED;
+- }
+-
+- return ret;
+-}
+-
+ static const struct of_device_id rcar_gen3_phy_usb2_match_table[] = {
+ {
+ .compatible = "renesas,usb2-phy-r8a77470",
+@@ -598,7 +611,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
+ struct phy_provider *provider;
+ struct resource *res;
+ const struct phy_ops *phy_usb2_ops;
+- int irq, ret = 0, i;
++ int ret = 0, i;
+
+ if (!dev->of_node) {
+ dev_err(dev, "This driver needs device tree\n");
+@@ -614,16 +627,8 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
+ if (IS_ERR(channel->base))
+ return PTR_ERR(channel->base);
+
+- /* call request_irq for OTG */
+- irq = platform_get_irq_optional(pdev, 0);
+- if (irq >= 0) {
+- INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work);
+- irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq,
+- IRQF_SHARED, dev_name(dev), channel);
+- if (irq < 0)
+- dev_err(dev, "No irq handler (%d)\n", irq);
+- }
+-
++ /* get irq number here and request_irq for OTG in phy_init */
++ channel->irq = platform_get_irq_optional(pdev, 0);
+ channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node);
+ if (channel->dr_mode != USB_DR_MODE_UNKNOWN) {
+ int ret;
+--
+2.25.1
+
--- /dev/null
+From 135e19963564d21bfe6dc834b3be1ae649a7f297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jun 2020 14:51:43 +0200
+Subject: pinctrl-single: fix pcs_parse_pinconf() return value
+
+From: Drew Fustini <drew@beagleboard.org>
+
+[ Upstream commit f46fe79ff1b65692a65266a5bec6dbe2bf7fc70f ]
+
+This patch causes pcs_parse_pinconf() to return -ENOTSUPP when no
+pinctrl_map is added. The current behavior is to return 0 when
+!PCS_HAS_PINCONF or !nconfs. Thus pcs_parse_one_pinctrl_entry()
+incorrectly assumes that a map was added and sets num_maps = 2.
+
+Analysis:
+=========
+The function pcs_parse_one_pinctrl_entry() calls pcs_parse_pinconf()
+if PCS_HAS_PINCONF is enabled. The function pcs_parse_pinconf()
+returns 0 to indicate there was no error and num_maps is then set to 2:
+
+ 980 static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs,
+ 981 struct device_node *np,
+ 982 struct pinctrl_map **map,
+ 983 unsigned *num_maps,
+ 984 const char **pgnames)
+ 985 {
+<snip>
+1053 (*map)->type = PIN_MAP_TYPE_MUX_GROUP;
+1054 (*map)->data.mux.group = np->name;
+1055 (*map)->data.mux.function = np->name;
+1056
+1057 if (PCS_HAS_PINCONF && function) {
+1058 res = pcs_parse_pinconf(pcs, np, function, map);
+1059 if (res)
+1060 goto free_pingroups;
+1061 *num_maps = 2;
+1062 } else {
+1063 *num_maps = 1;
+1064 }
+
+However, pcs_parse_pinconf() will also return 0 if !PCS_HAS_PINCONF or
+!nconfs. I believe these conditions should indicate that no map was
+added by returning -ENOTSUPP. Otherwise pcs_parse_one_pinctrl_entry()
+will set num_maps = 2 even though no maps were successfully added, as
+it does not reach "m++" on line 940:
+
+ 895 static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
+ 896 struct pcs_function *func,
+ 897 struct pinctrl_map **map)
+ 898
+ 899 {
+ 900 struct pinctrl_map *m = *map;
+<snip>
+ 917 /* If pinconf isn't supported, don't parse properties in below. */
+ 918 if (!PCS_HAS_PINCONF)
+ 919 return 0;
+ 920
+ 921 /* cacluate how much properties are supported in current node */
+ 922 for (i = 0; i < ARRAY_SIZE(prop2); i++) {
+ 923 if (of_find_property(np, prop2[i].name, NULL))
+ 924 nconfs++;
+ 925 }
+ 926 for (i = 0; i < ARRAY_SIZE(prop4); i++) {
+ 927 if (of_find_property(np, prop4[i].name, NULL))
+ 928 nconfs++;
+ 929 }
+ 930 if (!nconfs)
+ 919 return 0;
+ 932
+ 933 func->conf = devm_kcalloc(pcs->dev,
+ 934 nconfs, sizeof(struct pcs_conf_vals),
+ 935 GFP_KERNEL);
+ 936 if (!func->conf)
+ 937 return -ENOMEM;
+ 938 func->nconfs = nconfs;
+ 939 conf = &(func->conf[0]);
+ 940 m++;
+
+This situtation will cause a boot failure [0] on the BeagleBone Black
+(AM3358) when am33xx_pinmux node in arch/arm/boot/dts/am33xx-l4.dtsi
+has compatible = "pinconf-single" instead of "pinctrl-single".
+
+The patch fixes this issue by returning -ENOSUPP when !PCS_HAS_PINCONF
+or !nconfs, so that pcs_parse_one_pinctrl_entry() will know that no
+map was added.
+
+Logic is also added to pcs_parse_one_pinctrl_entry() to distinguish
+between -ENOSUPP and other errors. In the case of -ENOSUPP, num_maps
+is set to 1 as it is valid for pinconf to be enabled and a given pin
+group to not any pinconf properties.
+
+[0] https://lore.kernel.org/linux-omap/20200529175544.GA3766151@x1/
+
+Fixes: 9dddb4df90d1 ("pinctrl: single: support generic pinconf")
+Signed-off-by: Drew Fustini <drew@beagleboard.org>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20200608125143.GA2789203@x1
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index f3a8a465d27ec..02f677eb1d53f 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -916,7 +916,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
+
+ /* If pinconf isn't supported, don't parse properties in below. */
+ if (!PCS_HAS_PINCONF)
+- return 0;
++ return -ENOTSUPP;
+
+ /* cacluate how much properties are supported in current node */
+ for (i = 0; i < ARRAY_SIZE(prop2); i++) {
+@@ -928,7 +928,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
+ nconfs++;
+ }
+ if (!nconfs)
+- return 0;
++ return -ENOTSUPP;
+
+ func->conf = devm_kcalloc(pcs->dev,
+ nconfs, sizeof(struct pcs_conf_vals),
+@@ -1056,9 +1056,12 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs,
+
+ if (PCS_HAS_PINCONF && function) {
+ res = pcs_parse_pinconf(pcs, np, function, map);
+- if (res)
++ if (res == 0)
++ *num_maps = 2;
++ else if (res == -ENOTSUPP)
++ *num_maps = 1;
++ else
+ goto free_pingroups;
+- *num_maps = 2;
+ } else {
+ *num_maps = 1;
+ }
+--
+2.25.1
+
--- /dev/null
+From fdbae6fce07a0db804d3d47a453cce4f8cb0c50f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 11:43:21 +0200
+Subject: platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and
+ G15
+
+From: Armas Spann <zappel@retarded.farm>
+
+[ Upstream commit 13bceda68fb9ef388ad40d355ab8d03ee64d14c2 ]
+
+Add device support for the new ASUS ROG Zephyrus G14 (GA401I) and
+G15 (GA502I) series.
+
+This is accomplished by two new quirk entries (one per each series),
+as well as all current available G401I/G502I DMI_PRODUCT_NAMEs to match
+the corresponding devices.
+
+Signed-off-by: Armas Spann <zappel@retarded.farm>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 82 ++++++++++++++++++++++++++++++
+ 1 file changed, 82 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 8c4d00482ef06..6c42f73c1dfd3 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -110,6 +110,16 @@ static struct quirk_entry quirk_asus_forceals = {
+ .wmi_force_als_set = true,
+ };
+
++static struct quirk_entry quirk_asus_ga401i = {
++ .wmi_backlight_power = true,
++ .wmi_backlight_set_devstate = true,
++};
++
++static struct quirk_entry quirk_asus_ga502i = {
++ .wmi_backlight_power = true,
++ .wmi_backlight_set_devstate = true,
++};
++
+ static int dmi_matched(const struct dmi_system_id *dmi)
+ {
+ pr_info("Identified laptop model '%s'\n", dmi->ident);
+@@ -411,6 +421,78 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ .driver_data = &quirk_asus_forceals,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA401IH",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IH"),
++ },
++ .driver_data = &quirk_asus_ga401i,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA401II",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401II"),
++ },
++ .driver_data = &quirk_asus_ga401i,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA401IU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IU"),
++ },
++ .driver_data = &quirk_asus_ga401i,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA401IV",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IV"),
++ },
++ .driver_data = &quirk_asus_ga401i,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA401IVC",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IVC"),
++ },
++ .driver_data = &quirk_asus_ga401i,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA502II",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA502II"),
++ },
++ .driver_data = &quirk_asus_ga502i,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA502IU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA502IU"),
++ },
++ .driver_data = &quirk_asus_ga502i,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. GA502IV",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GA502IV"),
++ },
++ .driver_data = &quirk_asus_ga502i,
++ },
+ {},
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 3a7f6ac2483fc6e94eb2da124dac528a1e72a012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 17:30:17 +0800
+Subject: platform/x86: intel-hid: Fix return value check in check_acpi_dev()
+
+From: Lu Wei <luwei32@huawei.com>
+
+[ Upstream commit 71fbe886ce6dd0be17f20aded9c63fe58edd2806 ]
+
+In the function check_acpi_dev(), if it fails to create
+platform device, the return value is ERR_PTR() or NULL.
+Thus it must use IS_ERR_OR_NULL() to check return value.
+
+Fixes: ecc83e52b28c ("intel-hid: new hid event driver for hotkeys")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Lu Wei <luwei32@huawei.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel-hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index 9ee79b74311c1..86261970bd8f3 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -571,7 +571,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
+ return AE_OK;
+
+ if (acpi_match_device_ids(dev, ids) == 0)
+- if (acpi_create_platform_device(dev, NULL))
++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL)))
+ dev_info(&dev->dev,
+ "intel-hid: created platform device\n");
+
+--
+2.25.1
+
--- /dev/null
+From 45379cf4ff84536c94f53d872ca19b4473232c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 17:30:18 +0800
+Subject: platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
+
+From: Lu Wei <luwei32@huawei.com>
+
+[ Upstream commit 64dd4a5a7d214a07e3d9f40227ec30ac8ba8796e ]
+
+In the function check_acpi_dev(), if it fails to create
+platform device, the return value is ERR_PTR() or NULL.
+Thus it must use IS_ERR_OR_NULL() to check return value.
+
+Fixes: 332e081225fc ("intel-vbtn: new driver for Intel Virtual Button")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Lu Wei <luwei32@huawei.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel-vbtn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index 0487b606a2749..e85d8e58320c1 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -299,7 +299,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
+ return AE_OK;
+
+ if (acpi_match_device_ids(dev, ids) == 0)
+- if (acpi_create_platform_device(dev, NULL))
++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL)))
+ dev_info(&dev->dev,
+ "intel-vbtn: created platform device\n");
+
+--
+2.25.1
+
--- /dev/null
+From 122f9ada74811e57d95ad2b41f1d82d040ad6006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jul 2020 12:23:51 -0700
+Subject: power: supply: check if calc_soc succeeded in pm860x_init_battery
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit ccf193dee1f0fff55b556928591f7818bac1b3b1 ]
+
+clang static analysis flags this error
+
+88pm860x_battery.c:522:19: warning: Assigned value is
+ garbage or undefined [core.uninitialized.Assign]
+ info->start_soc = soc;
+ ^ ~~~
+soc is set by calling calc_soc.
+But calc_soc can return without setting soc.
+
+So check the return status and bail similarly to other
+checks in pm860x_init_battery and initialize soc to
+silence the warning.
+
+Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x")
+
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/88pm860x_battery.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/88pm860x_battery.c b/drivers/power/supply/88pm860x_battery.c
+index 1308f3a185f3d..590da88a17a25 100644
+--- a/drivers/power/supply/88pm860x_battery.c
++++ b/drivers/power/supply/88pm860x_battery.c
+@@ -433,7 +433,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info)
+ int ret;
+ int data;
+ int bat_remove;
+- int soc;
++ int soc = 0;
+
+ /* measure enable on GPADC1 */
+ data = MEAS1_GP1;
+@@ -496,7 +496,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info)
+ }
+ mutex_unlock(&info->lock);
+
+- calc_soc(info, OCV_MODE_ACTIVE, &soc);
++ ret = calc_soc(info, OCV_MODE_ACTIVE, &soc);
++ if (ret < 0)
++ goto out;
+
+ data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG);
+ bat_remove = data & BAT_WU_LOG;
+--
+2.25.1
+
--- /dev/null
+From c7e50bd235fb259136f5c75690636e16b7979da3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 23:17:24 +1000
+Subject: powerpc/32s: Fix CONFIG_BOOK3S_601 uses
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit df4d4ef22446b3a789a4efd74d34f2ec1e24deb2 ]
+
+We have two uses of CONFIG_BOOK3S_601, which doesn't exist. Fix them
+to use CONFIG_PPC_BOOK3S_601 which is the correct symbol.
+
+Fixes: 12c3f1fd87bf ("powerpc/32s: get rid of CPU_FTR_601 feature")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200724131728.1643966-5-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ptrace.h | 2 +-
+ arch/powerpc/include/asm/timex.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
+index ac3970fff0d5d..8b5814a36b76e 100644
+--- a/arch/powerpc/include/asm/ptrace.h
++++ b/arch/powerpc/include/asm/ptrace.h
+@@ -238,7 +238,7 @@ static inline void set_trap_norestart(struct pt_regs *regs)
+ }
+
+ #define arch_has_single_step() (1)
+-#ifndef CONFIG_BOOK3S_601
++#ifndef CONFIG_PPC_BOOK3S_601
+ #define arch_has_block_step() (true)
+ #else
+ #define arch_has_block_step() (false)
+diff --git a/arch/powerpc/include/asm/timex.h b/arch/powerpc/include/asm/timex.h
+index d2d2c4bd84358..6047402b0a4db 100644
+--- a/arch/powerpc/include/asm/timex.h
++++ b/arch/powerpc/include/asm/timex.h
+@@ -17,7 +17,7 @@ typedef unsigned long cycles_t;
+
+ static inline cycles_t get_cycles(void)
+ {
+- if (IS_ENABLED(CONFIG_BOOK3S_601))
++ if (IS_ENABLED(CONFIG_PPC_BOOK3S_601))
+ return 0;
+
+ return mftb();
+--
+2.25.1
+
--- /dev/null
+From 67e1bc7b1c743ce8f460592356b4252108a76f72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 08:59:24 +0530
+Subject: powerpc/book3s64/pkeys: Use PVR check instead of cpu feature
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit d79e7a5f26f1d179cbb915a8bf2469b6d7431c29 ]
+
+We are wrongly using CPU_FTRS_POWER8 to check for P8 support. Instead, we should
+use PVR value. Now considering we are using CPU_FTRS_POWER8, that
+implies we returned true for P9 with older firmware. Keep the same behavior
+by checking for P9 PVR value.
+
+Fixes: cf43d3b26452 ("powerpc: Enable pkey subsystem")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709032946.881753-2-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/pkeys.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/mm/book3s64/pkeys.c b/arch/powerpc/mm/book3s64/pkeys.c
+index d174106bab676..82ace6acb0aa9 100644
+--- a/arch/powerpc/mm/book3s64/pkeys.c
++++ b/arch/powerpc/mm/book3s64/pkeys.c
+@@ -83,13 +83,17 @@ static int pkey_initialize(void)
+ scan_pkey_feature();
+
+ /*
+- * Let's assume 32 pkeys on P8 bare metal, if its not defined by device
+- * tree. We make this exception since skiboot forgot to expose this
+- * property on power8.
++ * Let's assume 32 pkeys on P8/P9 bare metal, if its not defined by device
++ * tree. We make this exception since some version of skiboot forgot to
++ * expose this property on power8/9.
+ */
+- if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR) &&
+- cpu_has_feature(CPU_FTRS_POWER8))
+- pkeys_total = 32;
++ if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR)) {
++ unsigned long pvr = mfspr(SPRN_PVR);
++
++ if (PVR_VER(pvr) == PVR_POWER8 || PVR_VER(pvr) == PVR_POWER8E ||
++ PVR_VER(pvr) == PVR_POWER8NVL || PVR_VER(pvr) == PVR_POWER9)
++ pkeys_total = 32;
++ }
+
+ /*
+ * Adjust the upper limit, based on the number of bits supported by
+--
+2.25.1
+
--- /dev/null
+From 8ce2dae2a97499f2ea6c7f1014e4ce64062f5412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 23:17:26 +1000
+Subject: powerpc/boot: Fix CONFIG_PPC_MPC52XX references
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit e5eff89657e72a9050d95fde146b54c7dc165981 ]
+
+Commit 866bfc75f40e ("powerpc: conditionally compile platform-specific
+serial drivers") made some code depend on CONFIG_PPC_MPC52XX, which
+doesn't exist.
+
+Fix it to use CONFIG_PPC_MPC52xx.
+
+Fixes: 866bfc75f40e ("powerpc: conditionally compile platform-specific serial drivers")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200724131728.1643966-7-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/Makefile | 2 +-
+ arch/powerpc/boot/serial.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index 63d7456b95180..2039ed41250df 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -117,7 +117,7 @@ src-wlib-y := string.S crt0.S stdio.c decompress.c main.c \
+ elf_util.c $(zlib-y) devtree.c stdlib.c \
+ oflib.c ofconsole.c cuboot.c
+
+-src-wlib-$(CONFIG_PPC_MPC52XX) += mpc52xx-psc.c
++src-wlib-$(CONFIG_PPC_MPC52xx) += mpc52xx-psc.c
+ src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) += opal-calls.S opal.c
+ ifndef CONFIG_PPC64_BOOT_WRAPPER
+ src-wlib-y += crtsavres.S
+diff --git a/arch/powerpc/boot/serial.c b/arch/powerpc/boot/serial.c
+index 0bfa7e87e5460..9a19e5905485c 100644
+--- a/arch/powerpc/boot/serial.c
++++ b/arch/powerpc/boot/serial.c
+@@ -128,7 +128,7 @@ int serial_console_init(void)
+ dt_is_compatible(devp, "fsl,cpm2-smc-uart"))
+ rc = cpm_console_init(devp, &serial_cd);
+ #endif
+-#ifdef CONFIG_PPC_MPC52XX
++#ifdef CONFIG_PPC_MPC52xx
+ else if (dt_is_compatible(devp, "fsl,mpc5200-psc-uart"))
+ rc = mpc5200_psc_console_init(devp, &serial_cd);
+ #endif
+--
+2.25.1
+
--- /dev/null
+From b056aa49d1522ca1741388be60663f4afcf4d18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 07:48:25 +0000
+Subject: powerpc/fixmap: Fix FIX_EARLY_DEBUG_BASE when page size is 256k
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 03fd42d458fb9cb69e712600bd69ff77ff3a45a8 ]
+
+FIX_EARLY_DEBUG_BASE reserves a 128k area for debuging.
+
+When page size is 256k, the calculation results in a 0 number of
+pages, leading to the following failure:
+
+ CC arch/powerpc/kernel/asm-offsets.s
+In file included from ./arch/powerpc/include/asm/nohash/32/pgtable.h:77:0,
+ from ./arch/powerpc/include/asm/nohash/pgtable.h:8,
+ from ./arch/powerpc/include/asm/pgtable.h:20,
+ from ./include/linux/pgtable.h:6,
+ from ./arch/powerpc/include/asm/kup.h:42,
+ from ./arch/powerpc/include/asm/uaccess.h:9,
+ from ./include/linux/uaccess.h:11,
+ from ./include/linux/crypto.h:21,
+ from ./include/crypto/hash.h:11,
+ from ./include/linux/uio.h:10,
+ from ./include/linux/socket.h:8,
+ from ./include/linux/compat.h:15,
+ from arch/powerpc/kernel/asm-offsets.c:14:
+./arch/powerpc/include/asm/fixmap.h:75:2: error: overflow in enumeration values
+ __end_of_permanent_fixed_addresses,
+ ^
+make[2]: *** [arch/powerpc/kernel/asm-offsets.s] Error 1
+
+Ensure the debug area is at least one page.
+
+Fixes: b8e8efaa8639 ("powerpc: reserve fixmap entries for early debug")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/ca8c9f8249f523b1fab873e67b81b11989d46553.1592207216.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/fixmap.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/fixmap.h b/arch/powerpc/include/asm/fixmap.h
+index 29188810ba302..925cf89cbf4ba 100644
+--- a/arch/powerpc/include/asm/fixmap.h
++++ b/arch/powerpc/include/asm/fixmap.h
+@@ -52,7 +52,7 @@ enum fixed_addresses {
+ FIX_HOLE,
+ /* reserve the top 128K for early debugging purposes */
+ FIX_EARLY_DEBUG_TOP = FIX_HOLE,
+- FIX_EARLY_DEBUG_BASE = FIX_EARLY_DEBUG_TOP+((128*1024)/PAGE_SIZE)-1,
++ FIX_EARLY_DEBUG_BASE = FIX_EARLY_DEBUG_TOP+(ALIGN(SZ_128, PAGE_SIZE)/PAGE_SIZE)-1,
+ #ifdef CONFIG_HIGHMEM
+ FIX_KMAP_BEGIN, /* reserved pte's for temporary kernel mappings */
+ FIX_KMAP_END = FIX_KMAP_BEGIN+(KM_TYPE_NR*NR_CPUS)-1,
+--
+2.25.1
+
--- /dev/null
+From 3081df754e1e65c5bbb4ba6ecf63fa6127b22630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 07:18:06 -0700
+Subject: powerpc/mm: Fix typo in IS_ENABLED()
+
+From: Joe Perches <joe@perches.com>
+
+[ Upstream commit 55bd9ac468397c4f12a33b7ec714b5d0362c3aa2 ]
+
+IS_ENABLED() matches names exactly, so the missing "CONFIG_" prefix
+means this code would never be built.
+
+Also fixes a missing newline in pr_warn().
+
+Fixes: 970d54f99cea ("powerpc/book3s64/hash: Disable 16M linear mapping size if not aligned")
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/202006050717.A2F9809E@keescook
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/hash_utils.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/mm/book3s64/hash_utils.c b/arch/powerpc/mm/book3s64/hash_utils.c
+index 9b9f92ad0e7ab..3d5c9092feb19 100644
+--- a/arch/powerpc/mm/book3s64/hash_utils.c
++++ b/arch/powerpc/mm/book3s64/hash_utils.c
+@@ -663,11 +663,10 @@ static void __init htab_init_page_sizes(void)
+ * Pick a size for the linear mapping. Currently, we only
+ * support 16M, 1M and 4K which is the default
+ */
+- if (IS_ENABLED(STRICT_KERNEL_RWX) &&
++ if (IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) &&
+ (unsigned long)_stext % 0x1000000) {
+ if (mmu_psize_defs[MMU_PAGE_16M].shift)
+- pr_warn("Kernel not 16M aligned, "
+- "disabling 16M linear map alignment");
++ pr_warn("Kernel not 16M aligned, disabling 16M linear map alignment\n");
+ aligned = false;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 2e313647a8bcb486af1929a26643cff6d46426fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 18:49:23 +0530
+Subject: powerpc/mm/radix: Free PUD table when freeing pagetable
+
+From: Bharata B Rao <bharata@linux.ibm.com>
+
+[ Upstream commit 9ce8853b4a735c8115f55ac0e9c2b27a4c8f80b5 ]
+
+remove_pagetable() isn't freeing PUD table. This causes memory
+leak during memory unplug. Fix this.
+
+Fixes: 4b5d62ca17a1 ("powerpc/mm: add radix__remove_section_mapping()")
+Signed-off-by: Bharata B Rao <bharata@linux.ibm.com>
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709131925.922266-3-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/radix_pgtable.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c
+index bb00e0cba1195..c2989c1718839 100644
+--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
+@@ -700,6 +700,21 @@ static void free_pmd_table(pmd_t *pmd_start, pud_t *pud)
+ pud_clear(pud);
+ }
+
++static void free_pud_table(pud_t *pud_start, p4d_t *p4d)
++{
++ pud_t *pud;
++ int i;
++
++ for (i = 0; i < PTRS_PER_PUD; i++) {
++ pud = pud_start + i;
++ if (!pud_none(*pud))
++ return;
++ }
++
++ pud_free(&init_mm, pud_start);
++ p4d_clear(p4d);
++}
++
+ struct change_mapping_params {
+ pte_t *pte;
+ unsigned long start;
+@@ -874,6 +889,7 @@ static void __meminit remove_pagetable(unsigned long start, unsigned long end)
+
+ pud_base = (pud_t *)p4d_page_vaddr(*p4d);
+ remove_pud_table(pud_base, addr, next);
++ free_pud_table(pud_base, p4d);
+ }
+
+ spin_unlock(&init_mm.page_table_lock);
+--
+2.25.1
+
--- /dev/null
+From 6936a42ebc7066517bcc70d52860f3d1697b8950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jun 2020 14:06:04 +0530
+Subject: powerpc/perf: Fix missing is_sier_aviable() during build
+
+From: Madhavan Srinivasan <maddy@linux.ibm.com>
+
+[ Upstream commit 3c9450c053f88e525b2db1e6990cdf34d14e7696 ]
+
+Compilation error:
+ arch/powerpc/perf/perf_regs.c:80:undefined reference to `.is_sier_available'
+
+Currently is_sier_available() is part of core-book3s.c, which is added
+to build based on CONFIG_PPC_PERF_CTRS.
+
+A config with CONFIG_PERF_EVENTS and without CONFIG_PPC_PERF_CTRS will
+have a build break because of missing is_sier_available().
+
+In practice it only breaks when CONFIG_FSL_EMB_PERF_EVENT=n because
+that also guards the usage of is_sier_available(). That only happens
+with CONFIG_PPC_BOOK3E_64=y and CONFIG_FSL_SOC_BOOKE=n.
+
+Patch adds is_sier_available() in asm/perf_event.h to fix the build
+break for configs missing CONFIG_PPC_PERF_CTRS.
+
+Fixes: 333804dc3b7a ("powerpc/perf: Update perf_regs structure to include SIER")
+Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+[mpe: Add detail about CONFIG_FSL_SOC_BOOKE]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200614083604.302611-1-maddy@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/perf_event.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/perf_event.h b/arch/powerpc/include/asm/perf_event.h
+index eed3954082fa2..1e8b2e1ec1db6 100644
+--- a/arch/powerpc/include/asm/perf_event.h
++++ b/arch/powerpc/include/asm/perf_event.h
+@@ -12,6 +12,8 @@
+
+ #ifdef CONFIG_PPC_PERF_CTRS
+ #include <asm/perf_event_server.h>
++#else
++static inline bool is_sier_available(void) { return false; }
+ #endif
+
+ #ifdef CONFIG_FSL_EMB_PERF_EVENT
+--
+2.25.1
+
--- /dev/null
+From d425db18f148c2a6bc680722cdc4f9c43ed58659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 18:16:33 -0500
+Subject: powerpc/pseries/hotplug-cpu: Remove double free in error path
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit a0ff72f9f5a780341e7ff5e9ba50a0dad5fa1980 ]
+
+In the unlikely event that the device tree lacks a /cpus node,
+find_dlpar_cpus_to_add() oddly frees the cpu_drcs buffer it has been
+passed before returning an error. Its only caller also frees the
+buffer on error.
+
+Remove the less conventional kfree() of a caller-supplied buffer from
+find_dlpar_cpus_to_add().
+
+Fixes: 90edf184b9b7 ("powerpc/pseries: Add CPU dlpar add functionality")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190919231633.1344-1-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index d4b346355bb9e..6d4ee03d476a9 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -739,7 +739,6 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+ parent = of_find_node_by_path("/cpus");
+ if (!parent) {
+ pr_warn("Could not find CPU root node in device tree\n");
+- kfree(cpu_drcs);
+ return -1;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 7a0bd66b20da912ad5d1e589f087ae38771308ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 00:12:21 -0500
+Subject: powerpc/pseries: remove cede offline state for CPUs
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 48f6e7f6d948b56489da027bc3284c709b939d28 ]
+
+This effectively reverts commit 3aa565f53c39 ("powerpc/pseries: Add
+hooks to put the CPU into an appropriate offline state"), which added
+an offline mode for CPUs which uses the H_CEDE hcall instead of the
+architected stop-self RTAS function in order to facilitate "folding"
+of dedicated mode processors on PowerVM platforms to achieve energy
+savings. This has been the default offline mode since its
+introduction.
+
+There's nothing about stop-self that would prevent the hypervisor from
+achieving the energy savings available via H_CEDE, so the original
+premise of this change appears to be flawed.
+
+I also have encountered the claim that the transition to and from
+ceded state is much faster than stop-self/start-cpu. Certainly we
+would not want to use stop-self as an *idle* mode. That is what H_CEDE
+is for. However, this difference is insignificant in the context of
+Linux CPU hotplug, where the latency of an offline or online operation
+on current systems is on the order of 100ms, mainly attributable to
+all the various subsystems' cpuhp callbacks.
+
+The cede offline mode also prevents accurate accounting, as discussed
+before:
+https://lore.kernel.org/linuxppc-dev/1571740391-3251-1-git-send-email-ego@linux.vnet.ibm.com/
+
+Unconditionally use stop-self to offline processor threads. This is
+the architected method for offlining CPUs on PAPR systems.
+
+The "cede_offline" boot parameter is rendered obsolete.
+
+Removing this code enables the removal of the partition suspend code
+which temporarily onlines all present CPUs.
+
+Fixes: 3aa565f53c39 ("powerpc/pseries: Add hooks to put the CPU into an appropriate offline state")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200612051238.1007764-2-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/core-api/cpu_hotplug.rst | 7 -
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 170 ++----------------
+ .../platforms/pseries/offline_states.h | 38 ----
+ arch/powerpc/platforms/pseries/pmem.c | 1 -
+ arch/powerpc/platforms/pseries/smp.c | 28 +--
+ 5 files changed, 15 insertions(+), 229 deletions(-)
+ delete mode 100644 arch/powerpc/platforms/pseries/offline_states.h
+
+diff --git a/Documentation/core-api/cpu_hotplug.rst b/Documentation/core-api/cpu_hotplug.rst
+index 4a50ab7817f77..b1ae1ac159cf9 100644
+--- a/Documentation/core-api/cpu_hotplug.rst
++++ b/Documentation/core-api/cpu_hotplug.rst
+@@ -50,13 +50,6 @@ Command Line Switches
+
+ This option is limited to the X86 and S390 architecture.
+
+-``cede_offline={"off","on"}``
+- Use this option to disable/enable putting offlined processors to an extended
+- ``H_CEDE`` state on supported pseries platforms. If nothing is specified,
+- ``cede_offline`` is set to "on".
+-
+- This option is limited to the PowerPC architecture.
+-
+ ``cpu0_hotplug``
+ Allow to shutdown CPU0.
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index 3e8cbfe7a80fd..d4b346355bb9e 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -35,54 +35,10 @@
+ #include <asm/topology.h>
+
+ #include "pseries.h"
+-#include "offline_states.h"
+
+ /* This version can't take the spinlock, because it never returns */
+ static int rtas_stop_self_token = RTAS_UNKNOWN_SERVICE;
+
+-static DEFINE_PER_CPU(enum cpu_state_vals, preferred_offline_state) =
+- CPU_STATE_OFFLINE;
+-static DEFINE_PER_CPU(enum cpu_state_vals, current_state) = CPU_STATE_OFFLINE;
+-
+-static enum cpu_state_vals default_offline_state = CPU_STATE_OFFLINE;
+-
+-static bool cede_offline_enabled __read_mostly = true;
+-
+-/*
+- * Enable/disable cede_offline when available.
+- */
+-static int __init setup_cede_offline(char *str)
+-{
+- return (kstrtobool(str, &cede_offline_enabled) == 0);
+-}
+-
+-__setup("cede_offline=", setup_cede_offline);
+-
+-enum cpu_state_vals get_cpu_current_state(int cpu)
+-{
+- return per_cpu(current_state, cpu);
+-}
+-
+-void set_cpu_current_state(int cpu, enum cpu_state_vals state)
+-{
+- per_cpu(current_state, cpu) = state;
+-}
+-
+-enum cpu_state_vals get_preferred_offline_state(int cpu)
+-{
+- return per_cpu(preferred_offline_state, cpu);
+-}
+-
+-void set_preferred_offline_state(int cpu, enum cpu_state_vals state)
+-{
+- per_cpu(preferred_offline_state, cpu) = state;
+-}
+-
+-void set_default_offline_state(int cpu)
+-{
+- per_cpu(preferred_offline_state, cpu) = default_offline_state;
+-}
+-
+ static void rtas_stop_self(void)
+ {
+ static struct rtas_args args;
+@@ -101,9 +57,7 @@ static void rtas_stop_self(void)
+
+ static void pseries_mach_cpu_die(void)
+ {
+- unsigned int cpu = smp_processor_id();
+ unsigned int hwcpu = hard_smp_processor_id();
+- u8 cede_latency_hint = 0;
+
+ local_irq_disable();
+ idle_task_exit();
+@@ -112,49 +66,6 @@ static void pseries_mach_cpu_die(void)
+ else
+ xics_teardown_cpu();
+
+- if (get_preferred_offline_state(cpu) == CPU_STATE_INACTIVE) {
+- set_cpu_current_state(cpu, CPU_STATE_INACTIVE);
+- if (ppc_md.suspend_disable_cpu)
+- ppc_md.suspend_disable_cpu();
+-
+- cede_latency_hint = 2;
+-
+- get_lppaca()->idle = 1;
+- if (!lppaca_shared_proc(get_lppaca()))
+- get_lppaca()->donate_dedicated_cpu = 1;
+-
+- while (get_preferred_offline_state(cpu) == CPU_STATE_INACTIVE) {
+- while (!prep_irq_for_idle()) {
+- local_irq_enable();
+- local_irq_disable();
+- }
+-
+- extended_cede_processor(cede_latency_hint);
+- }
+-
+- local_irq_disable();
+-
+- if (!lppaca_shared_proc(get_lppaca()))
+- get_lppaca()->donate_dedicated_cpu = 0;
+- get_lppaca()->idle = 0;
+-
+- if (get_preferred_offline_state(cpu) == CPU_STATE_ONLINE) {
+- unregister_slb_shadow(hwcpu);
+-
+- hard_irq_disable();
+- /*
+- * Call to start_secondary_resume() will not return.
+- * Kernel stack will be reset and start_secondary()
+- * will be called to continue the online operation.
+- */
+- start_secondary_resume();
+- }
+- }
+-
+- /* Requested state is CPU_STATE_OFFLINE at this point */
+- WARN_ON(get_preferred_offline_state(cpu) != CPU_STATE_OFFLINE);
+-
+- set_cpu_current_state(cpu, CPU_STATE_OFFLINE);
+ unregister_slb_shadow(hwcpu);
+ rtas_stop_self();
+
+@@ -200,24 +111,13 @@ static void pseries_cpu_die(unsigned int cpu)
+ int cpu_status = 1;
+ unsigned int pcpu = get_hard_smp_processor_id(cpu);
+
+- if (get_preferred_offline_state(cpu) == CPU_STATE_INACTIVE) {
+- cpu_status = 1;
+- for (tries = 0; tries < 5000; tries++) {
+- if (get_cpu_current_state(cpu) == CPU_STATE_INACTIVE) {
+- cpu_status = 0;
+- break;
+- }
+- msleep(1);
+- }
+- } else if (get_preferred_offline_state(cpu) == CPU_STATE_OFFLINE) {
++ for (tries = 0; tries < 25; tries++) {
++ cpu_status = smp_query_cpu_stopped(pcpu);
++ if (cpu_status == QCSS_STOPPED ||
++ cpu_status == QCSS_HARDWARE_ERROR)
++ break;
++ cpu_relax();
+
+- for (tries = 0; tries < 25; tries++) {
+- cpu_status = smp_query_cpu_stopped(pcpu);
+- if (cpu_status == QCSS_STOPPED ||
+- cpu_status == QCSS_HARDWARE_ERROR)
+- break;
+- cpu_relax();
+- }
+ }
+
+ if (cpu_status != 0) {
+@@ -359,28 +259,15 @@ static int dlpar_offline_cpu(struct device_node *dn)
+ if (get_hard_smp_processor_id(cpu) != thread)
+ continue;
+
+- if (get_cpu_current_state(cpu) == CPU_STATE_OFFLINE)
++ if (!cpu_online(cpu))
+ break;
+
+- if (get_cpu_current_state(cpu) == CPU_STATE_ONLINE) {
+- set_preferred_offline_state(cpu,
+- CPU_STATE_OFFLINE);
+- cpu_maps_update_done();
+- timed_topology_update(1);
+- rc = device_offline(get_cpu_device(cpu));
+- if (rc)
+- goto out;
+- cpu_maps_update_begin();
+- break;
+- }
+-
+- /*
+- * The cpu is in CPU_STATE_INACTIVE.
+- * Upgrade it's state to CPU_STATE_OFFLINE.
+- */
+- set_preferred_offline_state(cpu, CPU_STATE_OFFLINE);
+- WARN_ON(plpar_hcall_norets(H_PROD, thread) != H_SUCCESS);
+- __cpu_die(cpu);
++ cpu_maps_update_done();
++ timed_topology_update(1);
++ rc = device_offline(get_cpu_device(cpu));
++ if (rc)
++ goto out;
++ cpu_maps_update_begin();
+ break;
+ }
+ if (cpu == num_possible_cpus()) {
+@@ -414,8 +301,6 @@ static int dlpar_online_cpu(struct device_node *dn)
+ for_each_present_cpu(cpu) {
+ if (get_hard_smp_processor_id(cpu) != thread)
+ continue;
+- BUG_ON(get_cpu_current_state(cpu)
+- != CPU_STATE_OFFLINE);
+ cpu_maps_update_done();
+ timed_topology_update(1);
+ find_and_online_cpu_nid(cpu);
+@@ -1013,27 +898,8 @@ static struct notifier_block pseries_smp_nb = {
+ .notifier_call = pseries_smp_notifier,
+ };
+
+-#define MAX_CEDE_LATENCY_LEVELS 4
+-#define CEDE_LATENCY_PARAM_LENGTH 10
+-#define CEDE_LATENCY_PARAM_MAX_LENGTH \
+- (MAX_CEDE_LATENCY_LEVELS * CEDE_LATENCY_PARAM_LENGTH * sizeof(char))
+-#define CEDE_LATENCY_TOKEN 45
+-
+-static char cede_parameters[CEDE_LATENCY_PARAM_MAX_LENGTH];
+-
+-static int parse_cede_parameters(void)
+-{
+- memset(cede_parameters, 0, CEDE_LATENCY_PARAM_MAX_LENGTH);
+- return rtas_call(rtas_token("ibm,get-system-parameter"), 3, 1,
+- NULL,
+- CEDE_LATENCY_TOKEN,
+- __pa(cede_parameters),
+- CEDE_LATENCY_PARAM_MAX_LENGTH);
+-}
+-
+ static int __init pseries_cpu_hotplug_init(void)
+ {
+- int cpu;
+ int qcss_tok;
+
+ #ifdef CONFIG_ARCH_CPU_PROBE_RELEASE
+@@ -1056,16 +922,8 @@ static int __init pseries_cpu_hotplug_init(void)
+ smp_ops->cpu_die = pseries_cpu_die;
+
+ /* Processors can be added/removed only on LPAR */
+- if (firmware_has_feature(FW_FEATURE_LPAR)) {
++ if (firmware_has_feature(FW_FEATURE_LPAR))
+ of_reconfig_notifier_register(&pseries_smp_nb);
+- cpu_maps_update_begin();
+- if (cede_offline_enabled && parse_cede_parameters() == 0) {
+- default_offline_state = CPU_STATE_INACTIVE;
+- for_each_online_cpu(cpu)
+- set_default_offline_state(cpu);
+- }
+- cpu_maps_update_done();
+- }
+
+ return 0;
+ }
+diff --git a/arch/powerpc/platforms/pseries/offline_states.h b/arch/powerpc/platforms/pseries/offline_states.h
+deleted file mode 100644
+index 51414aee28625..0000000000000
+--- a/arch/powerpc/platforms/pseries/offline_states.h
++++ /dev/null
+@@ -1,38 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _OFFLINE_STATES_H_
+-#define _OFFLINE_STATES_H_
+-
+-/* Cpu offline states go here */
+-enum cpu_state_vals {
+- CPU_STATE_OFFLINE,
+- CPU_STATE_INACTIVE,
+- CPU_STATE_ONLINE,
+- CPU_MAX_OFFLINE_STATES
+-};
+-
+-#ifdef CONFIG_HOTPLUG_CPU
+-extern enum cpu_state_vals get_cpu_current_state(int cpu);
+-extern void set_cpu_current_state(int cpu, enum cpu_state_vals state);
+-extern void set_preferred_offline_state(int cpu, enum cpu_state_vals state);
+-extern void set_default_offline_state(int cpu);
+-#else
+-static inline enum cpu_state_vals get_cpu_current_state(int cpu)
+-{
+- return CPU_STATE_ONLINE;
+-}
+-
+-static inline void set_cpu_current_state(int cpu, enum cpu_state_vals state)
+-{
+-}
+-
+-static inline void set_preferred_offline_state(int cpu, enum cpu_state_vals state)
+-{
+-}
+-
+-static inline void set_default_offline_state(int cpu)
+-{
+-}
+-#endif
+-
+-extern enum cpu_state_vals get_preferred_offline_state(int cpu);
+-#endif
+diff --git a/arch/powerpc/platforms/pseries/pmem.c b/arch/powerpc/platforms/pseries/pmem.c
+index f860a897a9e05..f827de7087e9b 100644
+--- a/arch/powerpc/platforms/pseries/pmem.c
++++ b/arch/powerpc/platforms/pseries/pmem.c
+@@ -24,7 +24,6 @@
+ #include <asm/topology.h>
+
+ #include "pseries.h"
+-#include "offline_states.h"
+
+ static struct device_node *pmem_node;
+
+diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
+index 6891710833be5..7ebacac03dc36 100644
+--- a/arch/powerpc/platforms/pseries/smp.c
++++ b/arch/powerpc/platforms/pseries/smp.c
+@@ -44,8 +44,6 @@
+ #include <asm/svm.h>
+
+ #include "pseries.h"
+-#include "offline_states.h"
+-
+
+ /*
+ * The Primary thread of each non-boot processor was started from the OF client
+@@ -108,10 +106,7 @@ static inline int smp_startup_cpu(unsigned int lcpu)
+
+ /* Fixup atomic count: it exited inside IRQ handler. */
+ task_thread_info(paca_ptrs[lcpu]->__current)->preempt_count = 0;
+-#ifdef CONFIG_HOTPLUG_CPU
+- if (get_cpu_current_state(lcpu) == CPU_STATE_INACTIVE)
+- goto out;
+-#endif
++
+ /*
+ * If the RTAS start-cpu token does not exist then presume the
+ * cpu is already spinning.
+@@ -126,9 +121,6 @@ static inline int smp_startup_cpu(unsigned int lcpu)
+ return 0;
+ }
+
+-#ifdef CONFIG_HOTPLUG_CPU
+-out:
+-#endif
+ return 1;
+ }
+
+@@ -143,10 +135,6 @@ static void smp_setup_cpu(int cpu)
+ vpa_init(cpu);
+
+ cpumask_clear_cpu(cpu, of_spin_mask);
+-#ifdef CONFIG_HOTPLUG_CPU
+- set_cpu_current_state(cpu, CPU_STATE_ONLINE);
+- set_default_offline_state(cpu);
+-#endif
+ }
+
+ static int smp_pSeries_kick_cpu(int nr)
+@@ -163,20 +151,6 @@ static int smp_pSeries_kick_cpu(int nr)
+ * the processor will continue on to secondary_start
+ */
+ paca_ptrs[nr]->cpu_start = 1;
+-#ifdef CONFIG_HOTPLUG_CPU
+- set_preferred_offline_state(nr, CPU_STATE_ONLINE);
+-
+- if (get_cpu_current_state(nr) == CPU_STATE_INACTIVE) {
+- long rc;
+- unsigned long hcpuid;
+-
+- hcpuid = get_hard_smp_processor_id(nr);
+- rc = plpar_hcall_norets(H_PROD, hcpuid);
+- if (rc != H_SUCCESS)
+- printk(KERN_ERR "Error: Prod to wake up processor %d "
+- "Ret= %ld\n", nr, rc);
+- }
+-#endif
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 0a79edfbaef974384e17f9116f7100d5b84511ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 00:12:22 -0500
+Subject: powerpc/rtas: don't online CPUs for partition suspend
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit ec2fc2a9e9bbad9023aab65bc472ce7a3ca8608f ]
+
+Partition suspension, used for hibernation and migration, requires
+that the OS place all but one of the LPAR's processor threads into one
+of two states prior to calling the ibm,suspend-me RTAS function:
+
+ * the architected offline state (via RTAS stop-self); or
+ * the H_JOIN hcall, which does not return until the partition
+ resumes execution
+
+Using H_CEDE as the offline mode, introduced by
+commit 3aa565f53c39 ("powerpc/pseries: Add hooks to put the CPU into
+an appropriate offline state"), means that any threads which are
+offline from Linux's point of view must be moved to one of those two
+states before a partition suspension can proceed.
+
+This was eventually addressed in commit 120496ac2d2d ("powerpc: Bring
+all threads online prior to migration/hibernation"), which added code
+to temporarily bring up any offline processor threads so they can call
+H_JOIN. Conceptually this is fine, but the implementation has had
+multiple races with cpu hotplug operations initiated from user
+space[1][2][3], the error handling is fragile, and it generates
+user-visible cpu hotplug events which is a lot of noise for a platform
+feature that's supposed to minimize disruption to workloads.
+
+With commit 3aa565f53c39 ("powerpc/pseries: Add hooks to put the CPU
+into an appropriate offline state") reverted, this code becomes
+unnecessary, so remove it. Since any offline CPUs now are truly
+offline from the platform's point of view, it is no longer necessary
+to bring up CPUs only to have them call H_JOIN and then go offline
+again upon resuming. Only active threads are required to call H_JOIN;
+stopped threads can be left alone.
+
+[1] commit a6717c01ddc2 ("powerpc/rtas: use device model APIs and
+ serialization during LPM")
+[2] commit 9fb603050ffd ("powerpc/rtas: retry when cpu offline races
+ with suspend/migration")
+[3] commit dfd718a2ed1f ("powerpc/rtas: Fix a potential race between
+ CPU-Offline & Migration")
+
+Fixes: 120496ac2d2d ("powerpc: Bring all threads online prior to migration/hibernation")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200612051238.1007764-3-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/rtas.h | 2 -
+ arch/powerpc/kernel/rtas.c | 122 +----------------------
+ arch/powerpc/platforms/pseries/suspend.c | 22 +---
+ 3 files changed, 3 insertions(+), 143 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
+index 014968f25f7e1..0107d724e9daa 100644
+--- a/arch/powerpc/include/asm/rtas.h
++++ b/arch/powerpc/include/asm/rtas.h
+@@ -253,8 +253,6 @@ extern int rtas_set_indicator_fast(int indicator, int index, int new_value);
+ extern void rtas_progress(char *s, unsigned short hex);
+ extern int rtas_suspend_cpu(struct rtas_suspend_me_data *data);
+ extern int rtas_suspend_last_cpu(struct rtas_suspend_me_data *data);
+-extern int rtas_online_cpus_mask(cpumask_var_t cpus);
+-extern int rtas_offline_cpus_mask(cpumask_var_t cpus);
+ extern int rtas_ibm_suspend_me(u64 handle);
+
+ struct rtc_time;
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index a09eba03f1809..806d554ce3577 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -843,96 +843,6 @@ static void rtas_percpu_suspend_me(void *info)
+ __rtas_suspend_cpu((struct rtas_suspend_me_data *)info, 1);
+ }
+
+-enum rtas_cpu_state {
+- DOWN,
+- UP,
+-};
+-
+-#ifndef CONFIG_SMP
+-static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
+- cpumask_var_t cpus)
+-{
+- if (!cpumask_empty(cpus)) {
+- cpumask_clear(cpus);
+- return -EINVAL;
+- } else
+- return 0;
+-}
+-#else
+-/* On return cpumask will be altered to indicate CPUs changed.
+- * CPUs with states changed will be set in the mask,
+- * CPUs with status unchanged will be unset in the mask. */
+-static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
+- cpumask_var_t cpus)
+-{
+- int cpu;
+- int cpuret = 0;
+- int ret = 0;
+-
+- if (cpumask_empty(cpus))
+- return 0;
+-
+- for_each_cpu(cpu, cpus) {
+- struct device *dev = get_cpu_device(cpu);
+-
+- switch (state) {
+- case DOWN:
+- cpuret = device_offline(dev);
+- break;
+- case UP:
+- cpuret = device_online(dev);
+- break;
+- }
+- if (cpuret < 0) {
+- pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
+- __func__,
+- ((state == UP) ? "up" : "down"),
+- cpu, cpuret);
+- if (!ret)
+- ret = cpuret;
+- if (state == UP) {
+- /* clear bits for unchanged cpus, return */
+- cpumask_shift_right(cpus, cpus, cpu);
+- cpumask_shift_left(cpus, cpus, cpu);
+- break;
+- } else {
+- /* clear bit for unchanged cpu, continue */
+- cpumask_clear_cpu(cpu, cpus);
+- }
+- }
+- cond_resched();
+- }
+-
+- return ret;
+-}
+-#endif
+-
+-int rtas_online_cpus_mask(cpumask_var_t cpus)
+-{
+- int ret;
+-
+- ret = rtas_cpu_state_change_mask(UP, cpus);
+-
+- if (ret) {
+- cpumask_var_t tmp_mask;
+-
+- if (!alloc_cpumask_var(&tmp_mask, GFP_KERNEL))
+- return ret;
+-
+- /* Use tmp_mask to preserve cpus mask from first failure */
+- cpumask_copy(tmp_mask, cpus);
+- rtas_offline_cpus_mask(tmp_mask);
+- free_cpumask_var(tmp_mask);
+- }
+-
+- return ret;
+-}
+-
+-int rtas_offline_cpus_mask(cpumask_var_t cpus)
+-{
+- return rtas_cpu_state_change_mask(DOWN, cpus);
+-}
+-
+ int rtas_ibm_suspend_me(u64 handle)
+ {
+ long state;
+@@ -940,8 +850,6 @@ int rtas_ibm_suspend_me(u64 handle)
+ unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+ struct rtas_suspend_me_data data;
+ DECLARE_COMPLETION_ONSTACK(done);
+- cpumask_var_t offline_mask;
+- int cpuret;
+
+ if (!rtas_service_present("ibm,suspend-me"))
+ return -ENOSYS;
+@@ -962,9 +870,6 @@ int rtas_ibm_suspend_me(u64 handle)
+ return -EIO;
+ }
+
+- if (!alloc_cpumask_var(&offline_mask, GFP_KERNEL))
+- return -ENOMEM;
+-
+ atomic_set(&data.working, 0);
+ atomic_set(&data.done, 0);
+ atomic_set(&data.error, 0);
+@@ -973,24 +878,8 @@ int rtas_ibm_suspend_me(u64 handle)
+
+ lock_device_hotplug();
+
+- /* All present CPUs must be online */
+- cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
+- cpuret = rtas_online_cpus_mask(offline_mask);
+- if (cpuret) {
+- pr_err("%s: Could not bring present CPUs online.\n", __func__);
+- atomic_set(&data.error, cpuret);
+- goto out;
+- }
+-
+ cpu_hotplug_disable();
+
+- /* Check if we raced with a CPU-Offline Operation */
+- if (!cpumask_equal(cpu_present_mask, cpu_online_mask)) {
+- pr_info("%s: Raced against a concurrent CPU-Offline\n", __func__);
+- atomic_set(&data.error, -EAGAIN);
+- goto out_hotplug_enable;
+- }
+-
+ /* Call function on all CPUs. One of us will make the
+ * rtas call
+ */
+@@ -1001,18 +890,11 @@ int rtas_ibm_suspend_me(u64 handle)
+ if (atomic_read(&data.error) != 0)
+ printk(KERN_ERR "Error doing global join\n");
+
+-out_hotplug_enable:
+- cpu_hotplug_enable();
+
+- /* Take down CPUs not online prior to suspend */
+- cpuret = rtas_offline_cpus_mask(offline_mask);
+- if (cpuret)
+- pr_warn("%s: Could not restore CPUs to offline state.\n",
+- __func__);
++ cpu_hotplug_enable();
+
+-out:
+ unlock_device_hotplug();
+- free_cpumask_var(offline_mask);
++
+ return atomic_read(&data.error);
+ }
+
+diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
+index 0a24a5a185f02..f789693f61f40 100644
+--- a/arch/powerpc/platforms/pseries/suspend.c
++++ b/arch/powerpc/platforms/pseries/suspend.c
+@@ -132,15 +132,11 @@ static ssize_t store_hibernate(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+- cpumask_var_t offline_mask;
+ int rc;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- if (!alloc_cpumask_var(&offline_mask, GFP_KERNEL))
+- return -ENOMEM;
+-
+ stream_id = simple_strtoul(buf, NULL, 16);
+
+ do {
+@@ -150,32 +146,16 @@ static ssize_t store_hibernate(struct device *dev,
+ } while (rc == -EAGAIN);
+
+ if (!rc) {
+- /* All present CPUs must be online */
+- cpumask_andnot(offline_mask, cpu_present_mask,
+- cpu_online_mask);
+- rc = rtas_online_cpus_mask(offline_mask);
+- if (rc) {
+- pr_err("%s: Could not bring present CPUs online.\n",
+- __func__);
+- goto out;
+- }
+-
+ stop_topology_update();
+ rc = pm_suspend(PM_SUSPEND_MEM);
+ start_topology_update();
+-
+- /* Take down CPUs not online prior to suspend */
+- if (!rtas_offline_cpus_mask(offline_mask))
+- pr_warn("%s: Could not restore CPUs to offline "
+- "state.\n", __func__);
+ }
+
+ stream_id = 0;
+
+ if (!rc)
+ rc = count;
+-out:
+- free_cpumask_var(offline_mask);
++
+ return rc;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 866000fa0826148b20c2d04453ff1b08a2d8f0d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jun 2020 10:55:54 +0200
+Subject: powerpc/spufs: Fix the type of ret in spufs_arch_write_note
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 7c7ff885c7bce40a487e41c68f1dac14dd2c8033 ]
+
+Both the ->dump method and snprintf return an int. So switch to an
+int and properly handle errors from ->dump.
+
+Fixes: 5456ffdee666 ("powerpc/spufs: simplify spufs core dumping")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200610085554.5647-1-hch@lst.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/cell/spufs/coredump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
+index 3b75e8f60609c..014d1c045bc3c 100644
+--- a/arch/powerpc/platforms/cell/spufs/coredump.c
++++ b/arch/powerpc/platforms/cell/spufs/coredump.c
+@@ -105,7 +105,7 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
+ size_t sz = spufs_coredump_read[i].size;
+ char fullname[80];
+ struct elf_note en;
+- size_t ret;
++ int ret;
+
+ sprintf(fullname, "SPU/%d/%s", dfd, spufs_coredump_read[i].name);
+ en.n_namesz = strlen(fullname) + 1;
+--
+2.25.1
+
--- /dev/null
+From 5ee90b799d0fae634db03f4fee9fe23896d0906b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 09:37:04 +1000
+Subject: powerpc/vdso: Fix vdso cpu truncation
+
+From: Milton Miller <miltonm@us.ibm.com>
+
+[ Upstream commit a9f675f950a07d5c1dbcbb97aabac56f5ed085e3 ]
+
+The code in vdso_cpu_init that exposes the cpu and numa node to
+userspace via SPRG_VDSO incorrctly masks the cpu to 12 bits. This means
+that any kernel running on a box with more than 4096 threads (NR_CPUS
+advertises a limit of of 8192 cpus) would expose userspace to two cpu
+contexts running at the same time with the same cpu number.
+
+Note: I'm not aware of any distro shipping a kernel with support for more
+than 4096 threads today, nor of any system image that currently exceeds
+4096 threads. Found via code browsing.
+
+Fixes: 18ad51dd342a7eb09dbcd059d0b451b616d4dafc ("powerpc: Add VDSO version of getcpu")
+Signed-off-by: Milton Miller <miltonm@us.ibm.com>
+Signed-off-by: Anton Blanchard <anton@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200715233704.1352257-1-anton@ozlabs.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/vdso.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
+index e0f4ba45b6cc7..8dad44262e751 100644
+--- a/arch/powerpc/kernel/vdso.c
++++ b/arch/powerpc/kernel/vdso.c
+@@ -677,7 +677,7 @@ int vdso_getcpu_init(void)
+ node = cpu_to_node(cpu);
+ WARN_ON_ONCE(node > 0xffff);
+
+- val = (cpu & 0xfff) | ((node & 0xffff) << 16);
++ val = (cpu & 0xffff) | ((node & 0xffff) << 16);
+ mtspr(SPRN_SPRG_VDSO_WRITE, val);
+ get_paca()->sprg_vdso = val;
+
+--
+2.25.1
+
--- /dev/null
+From 2802b411b36d14cf2d260a707d364f1af9fde787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 14:38:04 +0530
+Subject: powerpc/watchpoint: Fix 512 byte boundary limit
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit 3190ecbfeeb2ab17778887ce3fa964615d6460fd ]
+
+Milton Miller reported that we are aligning start and end address to
+wrong size SZ_512M. It should be SZ_512. Fix that.
+
+While doing this change I also found a case where ALIGN() comparison
+fails. Within a given aligned range, ALIGN() of two addresses does not
+match when start address is pointing to the first byte and end address
+is pointing to any other byte except the first one. But that's not true
+for ALIGN_DOWN(). ALIGN_DOWN() of any two addresses within that range
+will always point to the first byte. So use ALIGN_DOWN() instead of
+ALIGN().
+
+Fixes: e68ef121c1f4 ("powerpc/watchpoint: Use builtin ALIGN*() macros")
+Reported-by: Milton Miller <miltonm@us.ibm.com>
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Tested-by: Jordan Niethe <jniethe5@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200723090813.303838-2-ravi.bangoria@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index 0000daf0e1dae..031e6defc08e6 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -419,7 +419,7 @@ static int hw_breakpoint_validate_len(struct arch_hw_breakpoint *hw)
+ if (dawr_enabled()) {
+ max_len = DAWR_MAX_LEN;
+ /* DAWR region can't cross 512 bytes boundary */
+- if (ALIGN(start_addr, SZ_512M) != ALIGN(end_addr - 1, SZ_512M))
++ if (ALIGN_DOWN(start_addr, SZ_512) != ALIGN_DOWN(end_addr - 1, SZ_512))
+ return -EINVAL;
+ } else if (IS_ENABLED(CONFIG_PPC_8xx)) {
+ /* 8xx can setup a range without limitation */
+--
+2.25.1
+
--- /dev/null
+From 90b3abca0249e30fbb2670388740cb51abb1682a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 14:38:05 +0530
+Subject: powerpc/watchpoint: Fix DAWR exception constraint
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit f6780ce619f8daa285760302d56e95892087bd1f ]
+
+Pedro Miraglia Franco de Carvalho noticed that on p8/p9, DAR value is
+inconsistent with different type of load/store. Like for byte,word
+etc. load/stores, DAR is set to the address of the first byte of
+overlap between watch range and real access. But for quadword load/
+store it's sometime set to the address of the first byte of real
+access whereas sometime set to the address of the first byte of
+overlap. This issue has been fixed in p10. In p10(ISA 3.1), DAR is
+always set to the address of the first byte of overlap. Commit 27985b2a640e
+("powerpc/watchpoint: Don't ignore extraneous exceptions blindly")
+wrongly assumes that DAR is set to the address of the first byte of
+overlap for all load/stores on p8/p9 as well. Fix that. With the fix,
+we now rely on 'ea' provided by analyse_instr(). If analyse_instr()
+fails, generate event unconditionally on p8/p9, and on p10 generate
+event only if DAR is within a DAWR range.
+
+Note: 8xx is not affected.
+
+Fixes: 27985b2a640e ("powerpc/watchpoint: Don't ignore extraneous exceptions blindly")
+Fixes: 74c6881019b7 ("powerpc/watchpoint: Prepare handler to handle more than one watchpoint")
+Reported-by: Pedro Miraglia Franco de Carvalho <pedromfc@br.ibm.com>
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200723090813.303838-3-ravi.bangoria@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint.c | 72 ++++++++++++++++-------------
+ 1 file changed, 41 insertions(+), 31 deletions(-)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index 031e6defc08e6..a971e22aea819 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -498,11 +498,11 @@ static bool dar_in_user_range(unsigned long dar, struct arch_hw_breakpoint *info
+ return ((info->address <= dar) && (dar - info->address < info->len));
+ }
+
+-static bool dar_user_range_overlaps(unsigned long dar, int size,
+- struct arch_hw_breakpoint *info)
++static bool ea_user_range_overlaps(unsigned long ea, int size,
++ struct arch_hw_breakpoint *info)
+ {
+- return ((dar < info->address + info->len) &&
+- (dar + size > info->address));
++ return ((ea < info->address + info->len) &&
++ (ea + size > info->address));
+ }
+
+ static bool dar_in_hw_range(unsigned long dar, struct arch_hw_breakpoint *info)
+@@ -515,20 +515,22 @@ static bool dar_in_hw_range(unsigned long dar, struct arch_hw_breakpoint *info)
+ return ((hw_start_addr <= dar) && (hw_end_addr > dar));
+ }
+
+-static bool dar_hw_range_overlaps(unsigned long dar, int size,
+- struct arch_hw_breakpoint *info)
++static bool ea_hw_range_overlaps(unsigned long ea, int size,
++ struct arch_hw_breakpoint *info)
+ {
+ unsigned long hw_start_addr, hw_end_addr;
+
+ hw_start_addr = ALIGN_DOWN(info->address, HW_BREAKPOINT_SIZE);
+ hw_end_addr = ALIGN(info->address + info->len, HW_BREAKPOINT_SIZE);
+
+- return ((dar < hw_end_addr) && (dar + size > hw_start_addr));
++ return ((ea < hw_end_addr) && (ea + size > hw_start_addr));
+ }
+
+ /*
+ * If hw has multiple DAWR registers, we also need to check all
+ * dawrx constraint bits to confirm this is _really_ a valid event.
++ * If type is UNKNOWN, but privilege level matches, consider it as
++ * a positive match.
+ */
+ static bool check_dawrx_constraints(struct pt_regs *regs, int type,
+ struct arch_hw_breakpoint *info)
+@@ -553,7 +555,8 @@ static bool check_dawrx_constraints(struct pt_regs *regs, int type,
+ * including extraneous exception. Otherwise return false.
+ */
+ static bool check_constraints(struct pt_regs *regs, struct ppc_inst instr,
+- int type, int size, struct arch_hw_breakpoint *info)
++ unsigned long ea, int type, int size,
++ struct arch_hw_breakpoint *info)
+ {
+ bool in_user_range = dar_in_user_range(regs->dar, info);
+ bool dawrx_constraints;
+@@ -569,22 +572,27 @@ static bool check_constraints(struct pt_regs *regs, struct ppc_inst instr,
+ }
+
+ if (unlikely(ppc_inst_equal(instr, ppc_inst(0)))) {
+- if (in_user_range)
+- return true;
++ if (cpu_has_feature(CPU_FTR_ARCH_31) &&
++ !dar_in_hw_range(regs->dar, info))
++ return false;
+
+- if (dar_in_hw_range(regs->dar, info)) {
+- info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ;
+- return true;
+- }
+- return false;
++ return true;
+ }
+
+ dawrx_constraints = check_dawrx_constraints(regs, type, info);
+
+- if (dar_user_range_overlaps(regs->dar, size, info))
++ if (type == UNKNOWN) {
++ if (cpu_has_feature(CPU_FTR_ARCH_31) &&
++ !dar_in_hw_range(regs->dar, info))
++ return false;
++
+ return dawrx_constraints;
++ }
+
+- if (dar_hw_range_overlaps(regs->dar, size, info)) {
++ if (ea_user_range_overlaps(ea, size, info))
++ return dawrx_constraints;
++
++ if (ea_hw_range_overlaps(ea, size, info)) {
+ if (dawrx_constraints) {
+ info->type |= HW_BRK_TYPE_EXTRANEOUS_IRQ;
+ return true;
+@@ -594,7 +602,7 @@ static bool check_constraints(struct pt_regs *regs, struct ppc_inst instr,
+ }
+
+ static void get_instr_detail(struct pt_regs *regs, struct ppc_inst *instr,
+- int *type, int *size, bool *larx_stcx)
++ int *type, int *size, unsigned long *ea)
+ {
+ struct instruction_op op;
+
+@@ -602,16 +610,18 @@ static void get_instr_detail(struct pt_regs *regs, struct ppc_inst *instr,
+ return;
+
+ analyse_instr(&op, regs, *instr);
+-
+- /*
+- * Set size = 8 if analyse_instr() fails. If it's a userspace
+- * watchpoint(valid or extraneous), we can notify user about it.
+- * If it's a kernel watchpoint, instruction emulation will fail
+- * in stepping_handler() and watchpoint will be disabled.
+- */
+ *type = GETTYPE(op.type);
+- *size = !(*type == UNKNOWN) ? GETSIZE(op.type) : 8;
+- *larx_stcx = (*type == LARX || *type == STCX);
++ *ea = op.ea;
++#ifdef __powerpc64__
++ if (!(regs->msr & MSR_64BIT))
++ *ea &= 0xffffffffUL;
++#endif
++ *size = GETSIZE(op.type);
++}
++
++static bool is_larx_stcx_instr(int type)
++{
++ return type == LARX || type == STCX;
+ }
+
+ /*
+@@ -678,7 +688,7 @@ int hw_breakpoint_handler(struct die_args *args)
+ struct ppc_inst instr = ppc_inst(0);
+ int type = 0;
+ int size = 0;
+- bool larx_stcx = false;
++ unsigned long ea;
+
+ /* Disable breakpoints during exception handling */
+ hw_breakpoint_disable();
+@@ -692,7 +702,7 @@ int hw_breakpoint_handler(struct die_args *args)
+ rcu_read_lock();
+
+ if (!IS_ENABLED(CONFIG_PPC_8xx))
+- get_instr_detail(regs, &instr, &type, &size, &larx_stcx);
++ get_instr_detail(regs, &instr, &type, &size, &ea);
+
+ for (i = 0; i < nr_wp_slots(); i++) {
+ bp[i] = __this_cpu_read(bp_per_reg[i]);
+@@ -702,7 +712,7 @@ int hw_breakpoint_handler(struct die_args *args)
+ info[i] = counter_arch_bp(bp[i]);
+ info[i]->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ;
+
+- if (check_constraints(regs, instr, type, size, info[i])) {
++ if (check_constraints(regs, instr, ea, type, size, info[i])) {
+ if (!IS_ENABLED(CONFIG_PPC_8xx) &&
+ ppc_inst_equal(instr, ppc_inst(0))) {
+ handler_error(bp[i], info[i]);
+@@ -744,7 +754,7 @@ int hw_breakpoint_handler(struct die_args *args)
+ }
+
+ if (!IS_ENABLED(CONFIG_PPC_8xx)) {
+- if (larx_stcx) {
++ if (is_larx_stcx_instr(type)) {
+ for (i = 0; i < nr_wp_slots(); i++) {
+ if (!hit[i])
+ continue;
+--
+2.25.1
+
--- /dev/null
+From fa83a85cdd4e7b31ef8185acf9300b74c1f17adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 14:38:06 +0530
+Subject: powerpc/watchpoint: Fix DAWR exception for CACHEOP
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit f3c832f1350bcf1e6906113ee3168066f4235dbe ]
+
+'ea' returned by analyse_instr() needs to be aligned down to cache
+block size for CACHEOP instructions. analyse_instr() does not set
+size for CACHEOP, thus size also needs to be calculated manually.
+
+Fixes: 27985b2a640e ("powerpc/watchpoint: Don't ignore extraneous exceptions blindly")
+Fixes: 74c6881019b7 ("powerpc/watchpoint: Prepare handler to handle more than one watchpoint")
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200723090813.303838-4-ravi.bangoria@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index a971e22aea819..c55e67bab2710 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -538,7 +538,12 @@ static bool check_dawrx_constraints(struct pt_regs *regs, int type,
+ if (OP_IS_LOAD(type) && !(info->type & HW_BRK_TYPE_READ))
+ return false;
+
+- if (OP_IS_STORE(type) && !(info->type & HW_BRK_TYPE_WRITE))
++ /*
++ * The Cache Management instructions other than dcbz never
++ * cause a match. i.e. if type is CACHEOP, the instruction
++ * is dcbz, and dcbz is treated as Store.
++ */
++ if ((OP_IS_STORE(type) || type == CACHEOP) && !(info->type & HW_BRK_TYPE_WRITE))
+ return false;
+
+ if (is_kernel_addr(regs->nip) && !(info->type & HW_BRK_TYPE_KERNEL))
+@@ -601,6 +606,15 @@ static bool check_constraints(struct pt_regs *regs, struct ppc_inst instr,
+ return false;
+ }
+
++static int cache_op_size(void)
++{
++#ifdef __powerpc64__
++ return ppc64_caches.l1d.block_size;
++#else
++ return L1_CACHE_BYTES;
++#endif
++}
++
+ static void get_instr_detail(struct pt_regs *regs, struct ppc_inst *instr,
+ int *type, int *size, unsigned long *ea)
+ {
+@@ -616,7 +630,12 @@ static void get_instr_detail(struct pt_regs *regs, struct ppc_inst *instr,
+ if (!(regs->msr & MSR_64BIT))
+ *ea &= 0xffffffffUL;
+ #endif
++
+ *size = GETSIZE(op.type);
++ if (*type == CACHEOP) {
++ *size = cache_op_size();
++ *ea &= ~(*size - 1);
++ }
+ }
+
+ static bool is_larx_stcx_instr(int type)
+--
+2.25.1
+
--- /dev/null
+From 57cd2df7ed8ae69b911e339f03d017dd009f367f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 14:34:26 +0300
+Subject: qed: Fix ILT and XRCD bitmap memory leaks
+
+From: Yuval Basson <ybason@marvell.com>
+
+[ Upstream commit d4eae993fc45398526aed683e225d6fa713f8ddf ]
+
+- Free ILT lines used for XRC-SRQ's contexts.
+- Free XRCD bitmap
+
+Fixes: b8204ad878ce7 ("qed: changes to ILT to support XRC")
+Fixes: 7bfb399eca460 ("qed: Add XRC to RoCE")
+Signed-off-by: Michal Kalderon <mkalderon@marvell.com>
+Signed-off-by: Yuval Basson <ybason@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_cxt.c | 5 +++++
+ drivers/net/ethernet/qlogic/qed/qed_rdma.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+index d13ec88313c38..eb70fdddddbfe 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -2355,6 +2355,11 @@ qed_cxt_free_ilt_range(struct qed_hwfn *p_hwfn,
+ elem_size = SRQ_CXT_SIZE;
+ p_blk = &p_cli->pf_blks[SRQ_BLK];
+ break;
++ case QED_ELEM_XRC_SRQ:
++ p_cli = &p_hwfn->p_cxt_mngr->clients[ILT_CLI_TSDM];
++ elem_size = XRC_SRQ_CXT_SIZE;
++ p_blk = &p_cli->pf_blks[SRQ_BLK];
++ break;
+ case QED_ELEM_TASK:
+ p_cli = &p_hwfn->p_cxt_mngr->clients[ILT_CLI_CDUT];
+ elem_size = TYPE1_TASK_CXT_SIZE(p_hwfn);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 19c0c8864da13..4ad5f21de79ea 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -404,6 +404,7 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
+ qed_rdma_bmap_free(p_hwfn, &p_hwfn->p_rdma_info->srq_map, 1);
+ qed_rdma_bmap_free(p_hwfn, &p_hwfn->p_rdma_info->real_cid_map, 1);
+ qed_rdma_bmap_free(p_hwfn, &p_hwfn->p_rdma_info->xrc_srq_map, 1);
++ qed_rdma_bmap_free(p_hwfn, &p_hwfn->p_rdma_info->xrcd_map, 1);
+
+ kfree(p_rdma_info->port);
+ kfree(p_rdma_info->dev);
+--
+2.25.1
+
--- /dev/null
+From ba8c9b4970a18b659300f8bdba3e5344dd64284a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 14:49:10 +0800
+Subject: qtnfmac: Missing platform_device_unregister() on error in
+ qtnf_core_mac_alloc()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 141bc9abbbffa89d020957caa9ac4a61d0ef1e26 ]
+
+Add the missing platform_device_unregister() before return from
+qtnf_core_mac_alloc() in the error handling case.
+
+Fixes: 616f5701f4ab ("qtnfmac: assign each wiphy to its own virtual platform device")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Reviewed-by: Sergey Matyukevich <geomatsi@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200730064910.37589-1-wanghai38@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/quantenna/qtnfmac/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/core.c b/drivers/net/wireless/quantenna/qtnfmac/core.c
+index eea777f8acea5..6aafff9d4231b 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/core.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/core.c
+@@ -446,8 +446,11 @@ static struct qtnf_wmac *qtnf_core_mac_alloc(struct qtnf_bus *bus,
+ }
+
+ wiphy = qtnf_wiphy_allocate(bus, pdev);
+- if (!wiphy)
++ if (!wiphy) {
++ if (pdev)
++ platform_device_unregister(pdev);
+ return ERR_PTR(-ENOMEM);
++ }
+
+ mac = wiphy_priv(wiphy);
+
+--
+2.25.1
+
--- /dev/null
+From 234d0737ddd3bc8052e3593f84d43d4a7d3f5603 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 May 2020 23:47:47 +0200
+Subject: rcu/tree: Repeat the monitor if any free channel is busy
+
+From: Uladzislau Rezki (Sony) <urezki@gmail.com>
+
+[ Upstream commit 594aa5975b9b5cfe9edaec06170e43b8c0607377 ]
+
+It is possible that one of the channels cannot be detached
+because its free channel is busy and previously queued data
+has not been processed yet. On the other hand, another
+channel can be successfully detached causing the monitor
+work to stop.
+
+Prevent that by rescheduling the monitor work if there are
+any channels in the pending state after a detach attempt.
+
+Fixes: 34c881745549e ("rcu: Support kfree_bulk() interface in kfree_rcu()")
+Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 6c6569e0586c5..1e9e500ff7906 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -3105,7 +3105,7 @@ static void kfree_rcu_work(struct work_struct *work)
+ static inline bool queue_kfree_rcu_work(struct kfree_rcu_cpu *krcp)
+ {
+ struct kfree_rcu_cpu_work *krwp;
+- bool queued = false;
++ bool repeat = false;
+ int i;
+
+ lockdep_assert_held(&krcp->lock);
+@@ -3143,11 +3143,14 @@ static inline bool queue_kfree_rcu_work(struct kfree_rcu_cpu *krcp)
+ * been detached following each other, one by one.
+ */
+ queue_rcu_work(system_wq, &krwp->rcu_work);
+- queued = true;
+ }
++
++ /* Repeat if any "free" corresponding channel is still busy. */
++ if (krcp->bhead || krcp->head)
++ repeat = true;
+ }
+
+- return queued;
++ return !repeat;
+ }
+
+ static inline void kfree_rcu_drain_unlock(struct kfree_rcu_cpu *krcp,
+--
+2.25.1
+
--- /dev/null
+From 3da05245c9a181130852da10791d1aecb8c52a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 14:49:10 -0300
+Subject: RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 0cb42c0265837fafa2b4f302c8a7fed2631d7869 ]
+
+ib_unregister_device_queued() can only be used by drivers using the new
+dealloc_device callback flow, and it has a safety WARN_ON to ensure
+drivers are using it properly.
+
+However, if unregister and register are raced there is a special
+destruction path that maintains the uniform error handling semantic of
+'caller does ib_dealloc_device() on failure'. This requires disabling the
+dealloc_device callback which triggers the WARN_ON.
+
+Instead of using NULL to disable the callback use a special function
+pointer so the WARN_ON does not trigger.
+
+Fixes: d0899892edd0 ("RDMA/device: Provide APIs from the core code to help unregistration")
+Link: https://lore.kernel.org/r/0-v1-a36d512e0a99+762-syz_dealloc_driver_jgg@nvidia.com
+Reported-by: syzbot+4088ed905e4ae2b0e13b@syzkaller.appspotmail.com
+Suggested-by: Hillf Danton <hdanton@sina.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 905a2beaf8850..eadba29432dd7 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1339,6 +1339,10 @@ static int enable_device_and_get(struct ib_device *device)
+ return ret;
+ }
+
++static void prevent_dealloc_device(struct ib_device *ib_dev)
++{
++}
++
+ /**
+ * ib_register_device - Register an IB device with IB core
+ * @device: Device to register
+@@ -1409,11 +1413,11 @@ int ib_register_device(struct ib_device *device, const char *name)
+ * possibility for a parallel unregistration along with this
+ * error flow. Since we have a refcount here we know any
+ * parallel flow is stopped in disable_device and will see the
+- * NULL pointers, causing the responsibility to
++ * special dealloc_driver pointer, causing the responsibility to
+ * ib_dealloc_device() to revert back to this thread.
+ */
+ dealloc_fn = device->ops.dealloc_driver;
+- device->ops.dealloc_driver = NULL;
++ device->ops.dealloc_driver = prevent_dealloc_device;
+ ib_device_put(device);
+ __ib_unregister_device(device);
+ device->ops.dealloc_driver = dealloc_fn;
+@@ -1462,7 +1466,8 @@ static void __ib_unregister_device(struct ib_device *ib_dev)
+ * Drivers using the new flow may not call ib_dealloc_device except
+ * in error unwind prior to registration success.
+ */
+- if (ib_dev->ops.dealloc_driver) {
++ if (ib_dev->ops.dealloc_driver &&
++ ib_dev->ops.dealloc_driver != prevent_dealloc_device) {
+ WARN_ON(kref_read(&ib_dev->dev.kobj.kref) <= 1);
+ ib_dealloc_device(ib_dev);
+ }
+--
+2.25.1
+
--- /dev/null
+From aeda1e3242b3801d09edb99724c6e5f97890b3d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jul 2020 10:56:27 +0800
+Subject: RDMA/core: Fix return error value in _ib_modify_qp() to negative
+
+From: Li Heng <liheng40@huawei.com>
+
+[ Upstream commit 47fda651d5af2506deac57d54887cf55ce26e244 ]
+
+The error codes in _ib_modify_qp() are supposed to be negative errno.
+
+Fixes: 7a5c938b9ed0 ("IB/core: Check for rdma_protocol_ib only after validating port_num")
+Link: https://lore.kernel.org/r/1595645787-20375-1-git-send-email-liheng40@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Li Heng <liheng40@huawei.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index 53d6505c0c7b6..f369f0a19e851 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1712,7 +1712,7 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
+ if (!(rdma_protocol_ib(qp->device,
+ attr->alt_ah_attr.port_num) &&
+ rdma_protocol_ib(qp->device, port))) {
+- ret = EINVAL;
++ ret = -EINVAL;
+ goto out;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From f4a0582926b8ebc3df97834be9ade8e81bb74b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 18:42:20 +0800
+Subject: RDMA/hns: Fix error during modify qp RTS2RTS
+
+From: Lang Cheng <chenglang@huawei.com>
+
+[ Upstream commit 4327bd2c41412657ee2c8c0d8d3d1945268b4238 ]
+
+One qp state migrations legal configuration was deleted mistakenly.
+
+Fixes: 357f34294686 ("RDMA/hns: Simplify the state judgment code of qp")
+Link: https://lore.kernel.org/r/1595932941-40613-7-git-send-email-liweihang@huawei.com
+Signed-off-by: Lang Cheng <chenglang@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 0618ced45bf80..9833ce3e21f9e 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4301,7 +4301,9 @@ static bool check_qp_state(enum ib_qp_state cur_state,
+ [IB_QPS_RTR] = { [IB_QPS_RESET] = true,
+ [IB_QPS_RTS] = true,
+ [IB_QPS_ERR] = true },
+- [IB_QPS_RTS] = { [IB_QPS_RESET] = true, [IB_QPS_ERR] = true },
++ [IB_QPS_RTS] = { [IB_QPS_RESET] = true,
++ [IB_QPS_RTS] = true,
++ [IB_QPS_ERR] = true },
+ [IB_QPS_SQD] = {},
+ [IB_QPS_SQE] = {},
+ [IB_QPS_ERR] = { [IB_QPS_RESET] = true, [IB_QPS_ERR] = true }
+--
+2.25.1
+
--- /dev/null
+From f046d8e0c237228f398177fa26e41f9aec266ad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 18:42:21 +0800
+Subject: RDMA/hns: Fix the unneeded process when getting a general type of CQE
+ error
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit 395f2e8fd340c5bfad026f5968b56ec34cf20dd1 ]
+
+If the hns ROCEE reports a general error CQE (types not specified by the IB
+General Specifications), it's no need to change the QP state to error, and
+the driver should just skip it.
+
+Fixes: 7c044adca272 ("RDMA/hns: Simplify the cqe code of poll cq")
+Link: https://lore.kernel.org/r/1595932941-40613-8-git-send-email-liweihang@huawei.com
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 +++++++++
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 +
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 9833ce3e21f9e..eb71b941d21b7 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -3053,6 +3053,7 @@ static void get_cqe_status(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp,
+ IB_WC_RETRY_EXC_ERR },
+ { HNS_ROCE_CQE_V2_RNR_RETRY_EXC_ERR, IB_WC_RNR_RETRY_EXC_ERR },
+ { HNS_ROCE_CQE_V2_REMOTE_ABORT_ERR, IB_WC_REM_ABORT_ERR },
++ { HNS_ROCE_CQE_V2_GENERAL_ERR, IB_WC_GENERAL_ERR}
+ };
+
+ u32 cqe_status = roce_get_field(cqe->byte_4, V2_CQE_BYTE_4_STATUS_M,
+@@ -3074,6 +3075,14 @@ static void get_cqe_status(struct hns_roce_dev *hr_dev, struct hns_roce_qp *qp,
+ print_hex_dump(KERN_ERR, "", DUMP_PREFIX_NONE, 16, 4, cqe,
+ sizeof(*cqe), false);
+
++ /*
++ * For hns ROCEE, GENERAL_ERR is an error type that is not defined in
++ * the standard protocol, the driver must ignore it and needn't to set
++ * the QP to an error state.
++ */
++ if (cqe_status == HNS_ROCE_CQE_V2_GENERAL_ERR)
++ return;
++
+ /*
+ * Hip08 hardware cannot flush the WQEs in SQ/RQ if the QP state gets
+ * into errored mode. Hence, as a workaround to this hardware
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index e176b0aaa4ac2..e6c385ced1872 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -230,6 +230,7 @@ enum {
+ HNS_ROCE_CQE_V2_TRANSPORT_RETRY_EXC_ERR = 0x15,
+ HNS_ROCE_CQE_V2_RNR_RETRY_EXC_ERR = 0x16,
+ HNS_ROCE_CQE_V2_REMOTE_ABORT_ERR = 0x22,
++ HNS_ROCE_CQE_V2_GENERAL_ERR = 0x23,
+
+ HNS_ROCE_V2_CQE_STATUS_MASK = 0xff,
+ };
+--
+2.25.1
+
--- /dev/null
+From 74a4ba10f6fec74d0ca7192253a6d305a101e3fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 12:58:28 +0300
+Subject: RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit 1d70ad0f85435a7262de802b104e49e6598c50ff ]
+
+When dumping QPs bound to a counter, raw QPs should be allowed to dump
+without the CAP_NET_RAW privilege. This is consistent with what "rdma res
+show qp" does.
+
+Fixes: c4ffee7c9bdb ("RDMA/netlink: Implement counter dumpit calback")
+Link: https://lore.kernel.org/r/20200727095828.496195-1-leon@kernel.org
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/nldev.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index e16105be2eb23..98cd6403ca602 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -738,9 +738,6 @@ static int fill_stat_counter_qps(struct sk_buff *msg,
+ xa_lock(&rt->xa);
+ xa_for_each(&rt->xa, id, res) {
+ qp = container_of(res, struct ib_qp, res);
+- if (qp->qp_type == IB_QPT_RAW_PACKET && !capable(CAP_NET_RAW))
+- continue;
+-
+ if (!qp->counter || (qp->counter->id != counter->id))
+ continue;
+
+--
+2.25.1
+
--- /dev/null
+From 5cfbf5c5fa4c69a9c15c13ea4d48e1a1aaeedc81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 09:31:00 +0300
+Subject: RDMA/qedr: Add EDPM max size to alloc ucontext response
+
+From: Michal Kalderon <michal.kalderon@marvell.com>
+
+[ Upstream commit eb7f84e379daad69b4c92538baeaf93bbf493c14 ]
+
+User space should receive the maximum edpm size from kernel driver,
+similar to other edpm/ldpm related limits. Add an additional parameter to
+the alloc_ucontext_resp structure for the edpm maximum size.
+
+In addition, pass an indication from user-space to kernel
+(and not just kernel to user) that the DPM sizes are supported.
+
+This is for supporting backward-forward compatibility between driver and
+lib for everything related to DPM transaction and limit sizes.
+
+This should have been part of commit mentioned in Fixes tag.
+
+Link: https://lore.kernel.org/r/20200707063100.3811-3-michal.kalderon@marvell.com
+Fixes: 93a3d05f9d68 ("RDMA/qedr: Add kernel capability flags for dpm enabled mode")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 9 ++++++---
+ include/uapi/rdma/qedr-abi.h | 6 +++++-
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index bddd85e1c8c77..1a7f1f805be3e 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -320,9 +320,12 @@ int qedr_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata)
+ QEDR_DPM_TYPE_ROCE_LEGACY |
+ QEDR_DPM_TYPE_ROCE_EDPM_MODE;
+
+- uresp.dpm_flags |= QEDR_DPM_SIZES_SET;
+- uresp.ldpm_limit_size = QEDR_LDPM_MAX_SIZE;
+- uresp.edpm_trans_size = QEDR_EDPM_TRANS_SIZE;
++ if (ureq.context_flags & QEDR_SUPPORT_DPM_SIZES) {
++ uresp.dpm_flags |= QEDR_DPM_SIZES_SET;
++ uresp.ldpm_limit_size = QEDR_LDPM_MAX_SIZE;
++ uresp.edpm_trans_size = QEDR_EDPM_TRANS_SIZE;
++ uresp.edpm_limit_size = QEDR_EDPM_MAX_SIZE;
++ }
+
+ uresp.wids_enabled = 1;
+ uresp.wid_count = oparams.wid_count;
+diff --git a/include/uapi/rdma/qedr-abi.h b/include/uapi/rdma/qedr-abi.h
+index b261c9fca07bb..bf7333b2b5d71 100644
+--- a/include/uapi/rdma/qedr-abi.h
++++ b/include/uapi/rdma/qedr-abi.h
+@@ -40,7 +40,8 @@
+ /* user kernel communication data structures. */
+ enum qedr_alloc_ucontext_flags {
+ QEDR_ALLOC_UCTX_EDPM_MODE = 1 << 0,
+- QEDR_ALLOC_UCTX_DB_REC = 1 << 1
++ QEDR_ALLOC_UCTX_DB_REC = 1 << 1,
++ QEDR_SUPPORT_DPM_SIZES = 1 << 2,
+ };
+
+ struct qedr_alloc_ucontext_req {
+@@ -50,6 +51,7 @@ struct qedr_alloc_ucontext_req {
+
+ #define QEDR_LDPM_MAX_SIZE (8192)
+ #define QEDR_EDPM_TRANS_SIZE (64)
++#define QEDR_EDPM_MAX_SIZE (ROCE_REQ_MAX_INLINE_DATA_SIZE)
+
+ enum qedr_rdma_dpm_type {
+ QEDR_DPM_TYPE_NONE = 0,
+@@ -77,6 +79,8 @@ struct qedr_alloc_ucontext_resp {
+ __u16 ldpm_limit_size;
+ __u8 edpm_trans_size;
+ __u8 reserved;
++ __u16 edpm_limit_size;
++ __u8 padding[6];
+ };
+
+ struct qedr_alloc_pd_ureq {
+--
+2.25.1
+
--- /dev/null
+From 6ddd998e0983cf6ef8001a4996755e51c37b15be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 09:30:59 +0300
+Subject: RDMA/qedr: Add EDPM mode type for user-fw compatibility
+
+From: Michal Kalderon <michal.kalderon@marvell.com>
+
+[ Upstream commit bbe4f4245271bd0f21bf826996c0c5d87a3529c9 ]
+
+In older FW versions the completion flag was treated as the ack flag in
+edpm messages. commit ff937b916eb6 ("qed: Add EDPM mode type for user-fw
+compatibility") exposed the FW option of setting which mode the QP is in
+by adding a flag to the qedr <-> qed API.
+
+This patch adds the qedr <-> libqedr interface so that the libqedr can set
+the flag appropriately and qedr can pass it down to FW. Flag is added for
+backward compatibility with libqedr.
+
+For older libs, this flag didn't exist and therefore set to zero.
+
+Fixes: ac1b36e55a51 ("qedr: Add support for user context verbs")
+Link: https://lore.kernel.org/r/20200707063100.3811-2-michal.kalderon@marvell.com
+Signed-off-by: Yuval Bason <yuval.bason@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/qedr.h | 1 +
+ drivers/infiniband/hw/qedr/verbs.c | 11 ++++++++---
+ include/uapi/rdma/qedr-abi.h | 4 ++--
+ 3 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
+index aa332027da868..460292179b327 100644
+--- a/drivers/infiniband/hw/qedr/qedr.h
++++ b/drivers/infiniband/hw/qedr/qedr.h
+@@ -235,6 +235,7 @@ struct qedr_ucontext {
+ u32 dpi_size;
+ u16 dpi;
+ bool db_rec;
++ u8 edpm_mode;
+ };
+
+ union db_prod32 {
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index c6355e369a3a3..bddd85e1c8c77 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -275,7 +275,8 @@ int qedr_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata)
+ DP_ERR(dev, "Problem copying data from user space\n");
+ return -EFAULT;
+ }
+-
++ ctx->edpm_mode = !!(ureq.context_flags &
++ QEDR_ALLOC_UCTX_EDPM_MODE);
+ ctx->db_rec = !!(ureq.context_flags & QEDR_ALLOC_UCTX_DB_REC);
+ }
+
+@@ -316,7 +317,8 @@ int qedr_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata)
+ uresp.dpm_flags = QEDR_DPM_TYPE_IWARP_LEGACY;
+ else
+ uresp.dpm_flags = QEDR_DPM_TYPE_ROCE_ENHANCED |
+- QEDR_DPM_TYPE_ROCE_LEGACY;
++ QEDR_DPM_TYPE_ROCE_LEGACY |
++ QEDR_DPM_TYPE_ROCE_EDPM_MODE;
+
+ uresp.dpm_flags |= QEDR_DPM_SIZES_SET;
+ uresp.ldpm_limit_size = QEDR_LDPM_MAX_SIZE;
+@@ -1750,7 +1752,7 @@ static int qedr_create_user_qp(struct qedr_dev *dev,
+ struct qed_rdma_create_qp_out_params out_params;
+ struct qedr_pd *pd = get_qedr_pd(ibpd);
+ struct qedr_create_qp_uresp uresp;
+- struct qedr_ucontext *ctx = NULL;
++ struct qedr_ucontext *ctx = pd ? pd->uctx : NULL;
+ struct qedr_create_qp_ureq ureq;
+ int alloc_and_init = rdma_protocol_roce(&dev->ibdev, 1);
+ int rc = -EINVAL;
+@@ -1788,6 +1790,9 @@ static int qedr_create_user_qp(struct qedr_dev *dev,
+ in_params.rq_pbl_ptr = qp->urq.pbl_tbl->pa;
+ }
+
++ if (ctx)
++ SET_FIELD(in_params.flags, QED_ROCE_EDPM_MODE, ctx->edpm_mode);
++
+ qp->qed_qp = dev->ops->rdma_create_qp(dev->rdma_ctx,
+ &in_params, &out_params);
+
+diff --git a/include/uapi/rdma/qedr-abi.h b/include/uapi/rdma/qedr-abi.h
+index a0b83c9d4498b..b261c9fca07bb 100644
+--- a/include/uapi/rdma/qedr-abi.h
++++ b/include/uapi/rdma/qedr-abi.h
+@@ -39,7 +39,7 @@
+
+ /* user kernel communication data structures. */
+ enum qedr_alloc_ucontext_flags {
+- QEDR_ALLOC_UCTX_RESERVED = 1 << 0,
++ QEDR_ALLOC_UCTX_EDPM_MODE = 1 << 0,
+ QEDR_ALLOC_UCTX_DB_REC = 1 << 1
+ };
+
+@@ -56,7 +56,7 @@ enum qedr_rdma_dpm_type {
+ QEDR_DPM_TYPE_ROCE_ENHANCED = 1 << 0,
+ QEDR_DPM_TYPE_ROCE_LEGACY = 1 << 1,
+ QEDR_DPM_TYPE_IWARP_LEGACY = 1 << 2,
+- QEDR_DPM_TYPE_RESERVED = 1 << 3,
++ QEDR_DPM_TYPE_ROCE_EDPM_MODE = 1 << 3,
+ QEDR_DPM_SIZES_SET = 1 << 4,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 69eaa43443bc7b1c976220e0ba8b99f8bc0002bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 22:55:26 +0300
+Subject: RDMA/qedr: SRQ's bug fixes
+
+From: Yuval Basson <ybason@marvell.com>
+
+[ Upstream commit acca72e2b031b9fbb4184511072bd246a0abcebc ]
+
+QP's with the same SRQ, working on different CQs and running in parallel
+on different CPUs could lead to a race when maintaining the SRQ consumer
+count, and leads to FW running out of SRQs. Update the consumer
+atomically. Make sure the wqe_prod is updated after the sge_prod due to
+FW requirements.
+
+Fixes: 3491c9e799fb ("qedr: Add support for kernel mode SRQ's")
+Link: https://lore.kernel.org/r/20200708195526.31040-1-ybason@marvell.com
+Signed-off-by: Michal Kalderon <mkalderon@marvell.com>
+Signed-off-by: Yuval Basson <ybason@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/qedr.h | 4 ++--
+ drivers/infiniband/hw/qedr/verbs.c | 22 ++++++++++------------
+ 2 files changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
+index fdf90ecb26990..aa332027da868 100644
+--- a/drivers/infiniband/hw/qedr/qedr.h
++++ b/drivers/infiniband/hw/qedr/qedr.h
+@@ -344,10 +344,10 @@ struct qedr_srq_hwq_info {
+ u32 wqe_prod;
+ u32 sge_prod;
+ u32 wr_prod_cnt;
+- u32 wr_cons_cnt;
++ atomic_t wr_cons_cnt;
+ u32 num_elems;
+
+- u32 *virt_prod_pair_addr;
++ struct rdma_srq_producers *virt_prod_pair_addr;
+ dma_addr_t phy_prod_pair_addr;
+ };
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 9b9e802663674..c6355e369a3a3 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -3686,7 +3686,7 @@ static u32 qedr_srq_elem_left(struct qedr_srq_hwq_info *hw_srq)
+ * count and consumer count and subtract it from max
+ * work request supported so that we get elements left.
+ */
+- used = hw_srq->wr_prod_cnt - hw_srq->wr_cons_cnt;
++ used = hw_srq->wr_prod_cnt - (u32)atomic_read(&hw_srq->wr_cons_cnt);
+
+ return hw_srq->max_wr - used;
+ }
+@@ -3701,7 +3701,6 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+ unsigned long flags;
+ int status = 0;
+ u32 num_sge;
+- u32 offset;
+
+ spin_lock_irqsave(&srq->lock, flags);
+
+@@ -3714,7 +3713,8 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+ if (!qedr_srq_elem_left(hw_srq) ||
+ wr->num_sge > srq->hw_srq.max_sges) {
+ DP_ERR(dev, "Can't post WR (%d,%d) || (%d > %d)\n",
+- hw_srq->wr_prod_cnt, hw_srq->wr_cons_cnt,
++ hw_srq->wr_prod_cnt,
++ atomic_read(&hw_srq->wr_cons_cnt),
+ wr->num_sge, srq->hw_srq.max_sges);
+ status = -ENOMEM;
+ *bad_wr = wr;
+@@ -3748,22 +3748,20 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+ hw_srq->sge_prod++;
+ }
+
+- /* Flush WQE and SGE information before
++ /* Update WQE and SGE information before
+ * updating producer.
+ */
+- wmb();
++ dma_wmb();
+
+ /* SRQ producer is 8 bytes. Need to update SGE producer index
+ * in first 4 bytes and need to update WQE producer in
+ * next 4 bytes.
+ */
+- *srq->hw_srq.virt_prod_pair_addr = hw_srq->sge_prod;
+- offset = offsetof(struct rdma_srq_producers, wqe_prod);
+- *((u8 *)srq->hw_srq.virt_prod_pair_addr + offset) =
+- hw_srq->wqe_prod;
++ srq->hw_srq.virt_prod_pair_addr->sge_prod = hw_srq->sge_prod;
++ /* Make sure sge producer is updated first */
++ dma_wmb();
++ srq->hw_srq.virt_prod_pair_addr->wqe_prod = hw_srq->wqe_prod;
+
+- /* Flush producer after updating it. */
+- wmb();
+ wr = wr->next;
+ }
+
+@@ -4182,7 +4180,7 @@ static int process_resp_one_srq(struct qedr_dev *dev, struct qedr_qp *qp,
+ } else {
+ __process_resp_one(dev, qp, cq, wc, resp, wr_id);
+ }
+- srq->hw_srq.wr_cons_cnt++;
++ atomic_inc(&srq->hw_srq.wr_cons_cnt);
+
+ return 1;
+ }
+--
+2.25.1
+
--- /dev/null
+From 3103919001b84a501cb112dcb54cefdc611fc0e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 16:45:06 +0530
+Subject: RDMA/rtrs-clt: add an additional random 8 seconds before reconnecting
+
+From: Danil Kipnis <danil.kipnis@cloud.ionos.com>
+
+[ Upstream commit 09e0dbbeed82e35ce2cd21e086a6fac934163e2a ]
+
+In order to avoid all the clients to start reconnecting at the same time
+schedule the reconnect dwork with a random jitter of +[0,8] seconds.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20200724111508.15734-2-haris.iqbal@cloud.ionos.com
+Signed-off-by: Danil Kipnis <danil.kipnis@cloud.ionos.com>
+Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 564388a85603f..5b31d3b03737c 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -12,6 +12,7 @@
+
+ #include <linux/module.h>
+ #include <linux/rculist.h>
++#include <linux/random.h>
+
+ #include "rtrs-clt.h"
+ #include "rtrs-log.h"
+@@ -23,6 +24,12 @@
+ * leads to "false positives" failed reconnect attempts
+ */
+ #define RTRS_RECONNECT_BACKOFF 1000
++/*
++ * Wait for additional random time between 0 and 8 seconds
++ * before starting to reconnect to avoid clients reconnecting
++ * all at once in case of a major network outage
++ */
++#define RTRS_RECONNECT_SEED 8
+
+ MODULE_DESCRIPTION("RDMA Transport Client");
+ MODULE_LICENSE("GPL");
+@@ -306,7 +313,8 @@ static void rtrs_rdma_error_recovery(struct rtrs_clt_con *con)
+ */
+ delay_ms = clt->reconnect_delay_sec * 1000;
+ queue_delayed_work(rtrs_wq, &sess->reconnect_dwork,
+- msecs_to_jiffies(delay_ms));
++ msecs_to_jiffies(delay_ms +
++ prandom_u32() % RTRS_RECONNECT_SEED));
+ } else {
+ /*
+ * Error can happen just on establishing new connection,
+@@ -2503,7 +2511,9 @@ static void rtrs_clt_reconnect_work(struct work_struct *work)
+ sess->stats->reconnects.fail_cnt++;
+ delay_ms = clt->reconnect_delay_sec * 1000;
+ queue_delayed_work(rtrs_wq, &sess->reconnect_dwork,
+- msecs_to_jiffies(delay_ms));
++ msecs_to_jiffies(delay_ms +
++ prandom_u32() %
++ RTRS_RECONNECT_SEED));
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 1f0067829f42a6daafc7cd4e252fc35c5f00e524 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 16:45:08 +0530
+Subject: RDMA/rtrs: remove WQ_MEM_RECLAIM for rtrs_wq
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit 03ed5a8cda659e3c71d106b0dd4ce6520e4dcd6e ]
+
+lockdep triggers a warning from time to time when running a regression
+test:
+
+ rnbd_client L685: </dev/nullb0@bla> Device disconnected.
+ rnbd_client L1756: Unloading module
+
+ workqueue: WQ_MEM_RECLAIM rtrs_client_wq:rtrs_clt_reconnect_work [rtrs_client] is flushing !WQ_MEM_RECLAIM ib_addr:process_one_req [ib_core]
+ WARNING: CPU: 2 PID: 18824 at kernel/workqueue.c:2517 check_flush_dependency+0xad/0x130
+
+The root cause is workqueue core expect flushing should not be done for a
+!WQ_MEM_RECLAIM wq from a WQ_MEM_RECLAIM workqueue.
+
+In above case ib_addr workqueue without WQ_MEM_RECLAIM, but rtrs_wq
+WQ_MEM_RECLAIM.
+
+To avoid the warning, remove the WQ_MEM_RECLAIM flag.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20200724111508.15734-4-haris.iqbal@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 5b31d3b03737c..776e89231c52f 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -2982,7 +2982,7 @@ static int __init rtrs_client_init(void)
+ pr_err("Failed to create rtrs-client dev class\n");
+ return PTR_ERR(rtrs_clt_dev_class);
+ }
+- rtrs_wq = alloc_workqueue("rtrs_client_wq", WQ_MEM_RECLAIM, 0);
++ rtrs_wq = alloc_workqueue("rtrs_client_wq", 0, 0);
+ if (!rtrs_wq) {
+ class_destroy(rtrs_clt_dev_class);
+ return -ENOMEM;
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 0d9241f5d9e68..a219bd1bdbc26 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -2150,7 +2150,7 @@ static int __init rtrs_server_init(void)
+ err = PTR_ERR(rtrs_dev_class);
+ goto out_chunk_pool;
+ }
+- rtrs_wq = alloc_workqueue("rtrs_server_wq", WQ_MEM_RECLAIM, 0);
++ rtrs_wq = alloc_workqueue("rtrs_server_wq", 0, 0);
+ if (!rtrs_wq) {
+ err = -ENOMEM;
+ goto out_dev_class;
+--
+2.25.1
+
--- /dev/null
+From 74105015a207a45e32b267041f1480ac6a15ec78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 22:03:41 +0300
+Subject: RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send
+ queue
+
+From: Mikhail Malygin <m.malygin@yadro.com>
+
+[ Upstream commit 5f0b2a6093a4d9aab093964c65083fe801ef1e58 ]
+
+rxe_post_send_kernel() iterates over linked list of wr's, until the
+wr->next ptr is NULL. However if we've got an interrupt after last wr is
+posted, control may be returned to the code after send completion callback
+is executed and wr memory is freed.
+
+As a result, wr->next pointer may contain incorrect value leading to
+panic. Store the wr->next on the stack before posting it.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200716190340.23453-1-m.malygin@yadro.com
+Signed-off-by: Mikhail Malygin <m.malygin@yadro.com>
+Signed-off-by: Sergey Kojushev <s.kojushev@yadro.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index b8a22af724e8b..84fec5fd798d5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -684,6 +684,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ unsigned int mask;
+ unsigned int length = 0;
+ int i;
++ struct ib_send_wr *next;
+
+ while (wr) {
+ mask = wr_opcode_mask(wr->opcode, qp);
+@@ -700,6 +701,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ break;
+ }
+
++ next = wr->next;
++
+ length = 0;
+ for (i = 0; i < wr->num_sge; i++)
+ length += wr->sg_list[i].length;
+@@ -710,7 +713,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ *bad_wr = wr;
+ break;
+ }
+- wr = wr->next;
++ wr = next;
+ }
+
+ rxe_run_task(&qp->req.task, 1);
+--
+2.25.1
+
--- /dev/null
+From 75e52f798579c1c895df2665917e5b33f1c7c8cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 15:36:05 +0300
+Subject: RDMA/rxe: Skip dgid check in loopback mode
+
+From: Zhu Yanjun <yanjunz@mellanox.com>
+
+[ Upstream commit 5c99274be8864519328aa74bc550ba410095bc1c ]
+
+In the loopback tests, the following call trace occurs.
+
+ Call Trace:
+ __rxe_do_task+0x1a/0x30 [rdma_rxe]
+ rxe_qp_destroy+0x61/0xa0 [rdma_rxe]
+ rxe_destroy_qp+0x20/0x60 [rdma_rxe]
+ ib_destroy_qp_user+0xcc/0x220 [ib_core]
+ uverbs_free_qp+0x3c/0xc0 [ib_uverbs]
+ destroy_hw_idr_uobject+0x24/0x70 [ib_uverbs]
+ uverbs_destroy_uobject+0x43/0x1b0 [ib_uverbs]
+ uobj_destroy+0x41/0x70 [ib_uverbs]
+ __uobj_get_destroy+0x39/0x70 [ib_uverbs]
+ ib_uverbs_destroy_qp+0x88/0xc0 [ib_uverbs]
+ ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xb9/0xf0 [ib_uverbs]
+ ib_uverbs_cmd_verbs+0xb16/0xc30 [ib_uverbs]
+
+The root cause is that the actual RDMA connection is not created in the
+loopback tests and the rxe_match_dgid will fail randomly.
+
+To fix this call trace which appear in the loopback tests, skip check of
+the dgid.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200630123605.446959-1-leon@kernel.org
+Signed-off-by: Zhu Yanjun <yanjunz@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_recv.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index 831ad578a7b29..46e111c218fd4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -330,10 +330,14 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
+
+ static int rxe_match_dgid(struct rxe_dev *rxe, struct sk_buff *skb)
+ {
++ struct rxe_pkt_info *pkt = SKB_TO_PKT(skb);
+ const struct ib_gid_attr *gid_attr;
+ union ib_gid dgid;
+ union ib_gid *pdgid;
+
++ if (pkt->mask & RXE_LOOPBACK_MASK)
++ return 0;
++
+ if (skb->protocol == htons(ETH_P_IP)) {
+ ipv6_addr_set_v4mapped(ip_hdr(skb)->daddr,
+ (struct in6_addr *)&dgid);
+@@ -366,7 +370,7 @@ void rxe_rcv(struct sk_buff *skb)
+ if (unlikely(skb->len < pkt->offset + RXE_BTH_BYTES))
+ goto drop;
+
+- if (unlikely(rxe_match_dgid(rxe, skb) < 0)) {
++ if (rxe_match_dgid(rxe, skb) < 0) {
+ pr_warn_ratelimited("failed matching dgid\n");
+ goto drop;
+ }
+--
+2.25.1
+
--- /dev/null
+From 8a0487c5118007f9c53e0ff17c0f6f97b6a3fe50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 16:33:38 +0200
+Subject: recordmcount: only record relocation of type R_AARCH64_CALL26 on
+ arm64.
+
+From: Gregory Herrero <gregory.herrero@oracle.com>
+
+[ Upstream commit ea0eada45632f4807b2f49de951072283e2d781c ]
+
+Currently, if a section has a relocation to '_mcount' symbol, a new
+__mcount_loc entry will be added whatever the relocation type is.
+This is problematic when a relocation to '_mcount' is in the middle of a
+section and is not a call for ftrace use.
+
+Such relocation could be generated with below code for example:
+ bool is_mcount(unsigned long addr)
+ {
+ return (target == (unsigned long) &_mcount);
+ }
+
+With this snippet of code, ftrace will try to patch the mcount location
+generated by this code on module load and fail with:
+
+ Call trace:
+ ftrace_bug+0xa0/0x28c
+ ftrace_process_locs+0x2f4/0x430
+ ftrace_module_init+0x30/0x38
+ load_module+0x14f0/0x1e78
+ __do_sys_finit_module+0x100/0x11c
+ __arm64_sys_finit_module+0x28/0x34
+ el0_svc_common+0x88/0x194
+ el0_svc_handler+0x38/0x8c
+ el0_svc+0x8/0xc
+ ---[ end trace d828d06b36ad9d59 ]---
+ ftrace failed to modify
+ [<ffffa2dbf3a3a41c>] 0xffffa2dbf3a3a41c
+ actual: 66:a9:3c:90
+ Initializing ftrace call sites
+ ftrace record flags: 2000000
+ (0)
+ expected tramp: ffffa2dc6cf66724
+
+So Limit the relocation type to R_AARCH64_CALL26 as in perl version of
+recordmcount.
+
+Fixes: af64d2aa872a ("ftrace: Add arm64 support to recordmcount")
+Signed-off-by: Gregory Herrero <gregory.herrero@oracle.com>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Link: https://lore.kernel.org/r/20200717143338.19302-1-gregory.herrero@oracle.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/recordmcount.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index 7225107a9aafe..e59022b3f1254 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -434,6 +434,11 @@ static int arm_is_fake_mcount(Elf32_Rel const *rp)
+ return 1;
+ }
+
++static int arm64_is_fake_mcount(Elf64_Rel const *rp)
++{
++ return ELF64_R_TYPE(w(rp->r_info)) != R_AARCH64_CALL26;
++}
++
+ /* 64-bit EM_MIPS has weird ELF64_Rela.r_info.
+ * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf
+ * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40]
+@@ -547,6 +552,7 @@ static int do_file(char const *const fname)
+ make_nop = make_nop_arm64;
+ rel_type_nop = R_AARCH64_NONE;
+ ideal_nop = ideal_nop4_arm64;
++ is_fake_mcount64 = arm64_is_fake_mcount;
+ break;
+ case EM_IA_64: reltype = R_IA64_IMM64; break;
+ case EM_MIPS: /* reltype: e_class */ break;
+--
+2.25.1
+
--- /dev/null
+From e735d5c8adf55fda1d7eb6979178f78fd7da22b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 03:50:13 +0300
+Subject: regulator: fix memory leak on error path of regulator_register()
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 9177514ce34902b3adb2abd490b6ad05d1cfcb43 ]
+
+The change corrects registration and deregistration on error path
+of a regulator, the problem was manifested by a reported memory
+leak on deferred probe:
+
+ as3722-regulator as3722-regulator: regulator 13 register failed -517
+
+ # cat /sys/kernel/debug/kmemleak
+ unreferenced object 0xecc43740 (size 64):
+ comm "swapper/0", pid 1, jiffies 4294937640 (age 712.880s)
+ hex dump (first 32 bytes):
+ 72 65 67 75 6c 61 74 6f 72 2e 32 34 00 5a 5a 5a regulator.24.ZZZ
+ 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
+ backtrace:
+ [<0c4c3d1c>] __kmalloc_track_caller+0x15c/0x2c0
+ [<40c0ad48>] kvasprintf+0x64/0xd4
+ [<109abd29>] kvasprintf_const+0x70/0x84
+ [<c4215946>] kobject_set_name_vargs+0x34/0xa8
+ [<62282ea2>] dev_set_name+0x40/0x64
+ [<a39b6757>] regulator_register+0x3a4/0x1344
+ [<16a9543f>] devm_regulator_register+0x4c/0x84
+ [<51a4c6a1>] as3722_regulator_probe+0x294/0x754
+ ...
+
+The memory leak problem was introduced as a side ef another fix in
+regulator_register() error path, I believe that the proper fix is
+to decouple device_register() function into its two compounds and
+initialize a struct device before assigning any values to its fields
+and then using it before actual registration of a device happens.
+
+This lets to call put_device() safely after initialization, and, since
+now a release callback is called, kfree(rdev->constraints) shall be
+removed to exclude a double free condition.
+
+Fixes: a3cde9534ebd ("regulator: core: fix regulator_register() error paths to properly release rdev")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Cc: Wen Yang <wenyang@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20200724005013.23278-1-vz@mleia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 03154f5b939f7..720f28844795b 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -5023,7 +5023,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ struct regulator_dev *rdev;
+ bool dangling_cfg_gpiod = false;
+ bool dangling_of_gpiod = false;
+- bool reg_device_fail = false;
+ struct device *dev;
+ int ret, i;
+
+@@ -5152,10 +5151,12 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ }
+
+ /* register with sysfs */
++ device_initialize(&rdev->dev);
+ rdev->dev.class = ®ulator_class;
+ rdev->dev.parent = dev;
+ dev_set_name(&rdev->dev, "regulator.%lu",
+ (unsigned long) atomic_inc_return(®ulator_no));
++ dev_set_drvdata(&rdev->dev, rdev);
+
+ /* set regulator constraints */
+ if (init_data)
+@@ -5206,12 +5207,9 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ !rdev->desc->fixed_uV)
+ rdev->is_switch = true;
+
+- dev_set_drvdata(&rdev->dev, rdev);
+- ret = device_register(&rdev->dev);
+- if (ret != 0) {
+- reg_device_fail = true;
++ ret = device_add(&rdev->dev);
++ if (ret != 0)
+ goto unset_supplies;
+- }
+
+ rdev_init_debugfs(rdev);
+
+@@ -5233,17 +5231,15 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ mutex_unlock(®ulator_list_mutex);
+ wash:
+ kfree(rdev->coupling_desc.coupled_rdevs);
+- kfree(rdev->constraints);
+ mutex_lock(®ulator_list_mutex);
+ regulator_ena_gpio_free(rdev);
+ mutex_unlock(®ulator_list_mutex);
++ put_device(&rdev->dev);
++ rdev = NULL;
+ clean:
+ if (dangling_of_gpiod)
+ gpiod_put(config->ena_gpiod);
+- if (reg_device_fail)
+- put_device(&rdev->dev);
+- else
+- kfree(rdev);
++ kfree(rdev);
+ kfree(config);
+ rinse:
+ if (dangling_cfg_gpiod)
+--
+2.25.1
+
--- /dev/null
+From a5c9ed5ce3803f2eed345d8314ee992ba77738e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 21:00:41 +0800
+Subject: reset: intel: fix a compile warning about REG_OFFSET redefined
+
+From: Dejin Zheng <zhengdejin5@gmail.com>
+
+[ Upstream commit 308646785e51976dea7e20d29a1842d14bf0b9bd ]
+
+kernel test robot reports a compile warning about REG_OFFSET redefined
+in the reset-intel-gw.c after merging commit e44ab4e14d6f4 ("regmap:
+Simplify implementation of the regmap_read_poll_timeout() macro"). the
+warning is like that:
+
+drivers/reset/reset-intel-gw.c:18:0: warning: "REG_OFFSET" redefined
+ #define REG_OFFSET GENMASK(31, 16)
+
+In file included from ./arch/arm/mach-ixp4xx/include/mach/hardware.h:30:0,
+ from ./arch/arm/mach-ixp4xx/include/mach/io.h:15,
+ from ./arch/arm/include/asm/io.h:198,
+ from ./include/linux/io.h:13,
+ from ./include/linux/iopoll.h:14,
+ from ./include/linux/regmap.h:20,
+ from drivers/reset/reset-intel-gw.c:12:
+./arch/arm/mach-ixp4xx/include/mach/platform.h:25:0: note: this is the location of the previous definition
+ #define REG_OFFSET 3
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: c9aef213e38cde ("reset: intel: Add system reset controller driver")
+Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-intel-gw.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/reset/reset-intel-gw.c b/drivers/reset/reset-intel-gw.c
+index 854238444616b..effc177db80af 100644
+--- a/drivers/reset/reset-intel-gw.c
++++ b/drivers/reset/reset-intel-gw.c
+@@ -15,9 +15,9 @@
+ #define RCU_RST_STAT 0x0024
+ #define RCU_RST_REQ 0x0048
+
+-#define REG_OFFSET GENMASK(31, 16)
+-#define BIT_OFFSET GENMASK(15, 8)
+-#define STAT_BIT_OFFSET GENMASK(7, 0)
++#define REG_OFFSET_MASK GENMASK(31, 16)
++#define BIT_OFFSET_MASK GENMASK(15, 8)
++#define STAT_BIT_OFFSET_MASK GENMASK(7, 0)
+
+ #define to_reset_data(x) container_of(x, struct intel_reset_data, rcdev)
+
+@@ -51,11 +51,11 @@ static u32 id_to_reg_and_bit_offsets(struct intel_reset_data *data,
+ unsigned long id, u32 *rst_req,
+ u32 *req_bit, u32 *stat_bit)
+ {
+- *rst_req = FIELD_GET(REG_OFFSET, id);
+- *req_bit = FIELD_GET(BIT_OFFSET, id);
++ *rst_req = FIELD_GET(REG_OFFSET_MASK, id);
++ *req_bit = FIELD_GET(BIT_OFFSET_MASK, id);
+
+ if (data->soc_data->legacy)
+- *stat_bit = FIELD_GET(STAT_BIT_OFFSET, id);
++ *stat_bit = FIELD_GET(STAT_BIT_OFFSET_MASK, id);
+ else
+ *stat_bit = *req_bit;
+
+@@ -141,14 +141,14 @@ static int intel_reset_xlate(struct reset_controller_dev *rcdev,
+ if (spec->args[1] > 31)
+ return -EINVAL;
+
+- id = FIELD_PREP(REG_OFFSET, spec->args[0]);
+- id |= FIELD_PREP(BIT_OFFSET, spec->args[1]);
++ id = FIELD_PREP(REG_OFFSET_MASK, spec->args[0]);
++ id |= FIELD_PREP(BIT_OFFSET_MASK, spec->args[1]);
+
+ if (data->soc_data->legacy) {
+ if (spec->args[2] > 31)
+ return -EINVAL;
+
+- id |= FIELD_PREP(STAT_BIT_OFFSET, spec->args[2]);
++ id |= FIELD_PREP(STAT_BIT_OFFSET_MASK, spec->args[2]);
+ }
+
+ return id;
+@@ -210,11 +210,11 @@ static int intel_reset_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- data->reboot_id = FIELD_PREP(REG_OFFSET, rb_id[0]);
+- data->reboot_id |= FIELD_PREP(BIT_OFFSET, rb_id[1]);
++ data->reboot_id = FIELD_PREP(REG_OFFSET_MASK, rb_id[0]);
++ data->reboot_id |= FIELD_PREP(BIT_OFFSET_MASK, rb_id[1]);
+
+ if (data->soc_data->legacy)
+- data->reboot_id |= FIELD_PREP(STAT_BIT_OFFSET, rb_id[2]);
++ data->reboot_id |= FIELD_PREP(STAT_BIT_OFFSET_MASK, rb_id[2]);
+
+ data->restart_nb.notifier_call = intel_reset_restart_handler;
+ data->restart_nb.priority = 128;
+--
+2.25.1
+
--- /dev/null
+From 32264c27a283158268d52ccbb1176ea84bbeb0f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 10:41:31 +0800
+Subject: Revert "vxlan: fix tos value before xmit"
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit a0dced17ad9dc08b1b25e0065b54c97a318e6e8b ]
+
+This reverts commit 71130f29979c7c7956b040673e6b9d5643003176.
+
+In commit 71130f29979c ("vxlan: fix tos value before xmit") we want to
+make sure the tos value are filtered by RT_TOS() based on RFC1349.
+
+ 0 1 2 3 4 5 6 7
+ +-----+-----+-----+-----+-----+-----+-----+-----+
+ | PRECEDENCE | TOS | MBZ |
+ +-----+-----+-----+-----+-----+-----+-----+-----+
+
+But RFC1349 has been obsoleted by RFC2474. The new DSCP field defined like
+
+ 0 1 2 3 4 5 6 7
+ +-----+-----+-----+-----+-----+-----+-----+-----+
+ | DS FIELD, DSCP | ECN FIELD |
+ +-----+-----+-----+-----+-----+-----+-----+-----+
+
+So with
+
+IPTOS_TOS_MASK 0x1E
+RT_TOS(tos) ((tos)&IPTOS_TOS_MASK)
+
+the first 3 bits DSCP info will get lost.
+
+To take all the DSCP info in xmit, we should revert the patch and just push
+all tos bits to ip_tunnel_ecn_encap(), which will handling ECN field later.
+
+Fixes: 71130f29979c ("vxlan: fix tos value before xmit")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index a7c3939264b00..35a7d409d8d36 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2722,7 +2722,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ ndst = &rt->dst;
+ skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM);
+
+- tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
++ tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
+ err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
+ vni, md, flags, udp_sum);
+@@ -2762,7 +2762,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+
+ skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM);
+
+- tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
++ tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ ttl = ttl ? : ip6_dst_hoplimit(ndst);
+ skb_scrub_packet(skb, xnet);
+ err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
+--
+2.25.1
+
--- /dev/null
+From a8932f91d781cf58cd03ff919f836346bd4a4d10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 16:27:45 +0800
+Subject: rtw88: 8822ce: add support for device ID 0xc82f
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+[ Upstream commit 7d428b1c9ffc9ddcdd64c6955836bbb17a233ef3 ]
+
+New device ID 0xc82f found on Lenovo ThinkCenter.
+Tested it with c822 driver, works good.
+
+PCI id:
+03:00.0 Network controller [0280]: Realtek Semiconductor Co., Ltd.
+Device [10ec:c82f]
+ Subsystem: Lenovo Device [17aa:c02f]
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200612082745.204400-1-aaron.ma@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822ce.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822ce.c b/drivers/net/wireless/realtek/rtw88/rtw8822ce.c
+index 7b6bd990651e1..026ac49ce6e3c 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822ce.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822ce.c
+@@ -11,6 +11,10 @@ static const struct pci_device_id rtw_8822ce_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0xC822),
+ .driver_data = (kernel_ulong_t)&rtw8822c_hw_spec
+ },
++ {
++ PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0xC82F),
++ .driver_data = (kernel_ulong_t)&rtw8822c_hw_spec
++ },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, rtw_8822ce_id_table);
+--
+2.25.1
+
--- /dev/null
+From 947f5427f35498b46bd89fdbd90d9e6a110ba622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 14:49:34 +0800
+Subject: rtw88: coex: only skip coex triggered by BT info
+
+From: Yan-Hsuan Chuang <yhchuang@realtek.com>
+
+[ Upstream commit 3f194bd4ca1cd9b8eef34d37d562279dbeb80319 ]
+
+The coex mechanism used to skip upon the freeze flag is raised.
+That will cause the coex mechanism being skipped unexpectedly.
+Coex only wanted to keep the TDMA table from being changed by
+BT side.
+
+So, check the freeze and reason, if the coex reason is coming
+from BT info, skip it, to make sure the coex triggered by Wifi
+itself can work.
+
+This is required for the AP mode, while the control flow is
+different with STA mode. When starting an AP mode, the AP mode
+needs to start working immedaitely after leaving IPS, and the
+freeze flag could be raised. If the coex info is skipped, then
+the AP mode will not set the antenna owner, leads to TX stuck.
+
+Fixes: 4136214f7c46 ("rtw88: add BT co-existence support")
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200717064937.27966-5-yhchuang@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/coex.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c
+index cbf3d503df1c9..30ebe426a4abb 100644
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -1934,7 +1934,8 @@ static void rtw_coex_run_coex(struct rtw_dev *rtwdev, u8 reason)
+ if (coex_stat->wl_under_ips)
+ return;
+
+- if (coex->freeze && !coex_stat->bt_setup_link)
++ if (coex->freeze && coex_dm->reason == COEX_RSN_BTINFO &&
++ !coex_stat->bt_setup_link)
+ return;
+
+ coex_stat->cnt_wl[COEX_CNT_WL_COEXRUN]++;
+--
+2.25.1
+
--- /dev/null
+From 8c19f158aae507a2b1c3bfe7e0b4d64df01c9bb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 14:49:31 +0800
+Subject: rtw88: fix LDPC field for RA info
+
+From: Tsang-Shian Lin <thlin@realtek.com>
+
+[ Upstream commit ae44fa993e8e6c1a1d22e5ca03d9eadd53b2745b ]
+
+Convert the type of LDPC field to boolen because
+LDPC field of RA info H2C command to firmware
+is only one bit.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Tsang-Shian Lin <thlin@realtek.com>
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200717064937.27966-2-yhchuang@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/fw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
+index 6478fd7a78f64..13e79482f6d59 100644
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -456,7 +456,7 @@ void rtw_fw_send_ra_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ SET_RA_INFO_INIT_RA_LVL(h2c_pkt, si->init_ra_lv);
+ SET_RA_INFO_SGI_EN(h2c_pkt, si->sgi_enable);
+ SET_RA_INFO_BW_MODE(h2c_pkt, si->bw_mode);
+- SET_RA_INFO_LDPC(h2c_pkt, si->ldpc_en);
++ SET_RA_INFO_LDPC(h2c_pkt, !!si->ldpc_en);
+ SET_RA_INFO_NO_UPDATE(h2c_pkt, no_update);
+ SET_RA_INFO_VHT_EN(h2c_pkt, si->vht_enable);
+ SET_RA_INFO_DIS_PT(h2c_pkt, disable_pt);
+--
+2.25.1
+
--- /dev/null
+From b82c0c1ac3dd3f705eee05658c2063e7b096b24d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 14:49:32 +0800
+Subject: rtw88: fix short GI capability based on current bandwidth
+
+From: Tsang-Shian Lin <thlin@realtek.com>
+
+[ Upstream commit 4dd86b901d1373ef8446ecb50a7ca009f3475211 ]
+
+Fix the transmission is not sent with short GI under
+some conditions even if the receiver supports short GI.
+If VHT capability IE exists in the beacon, the original
+code uses the short GI for 80M field as driver's short GI
+setting for transmission, even the current bandwidth is
+not 80MHz.
+
+Short GI supported fields for 20M/40M are informed in HT
+capability information element, and short GI supported
+field for 80M is informed in VHT capability information
+element.
+
+These three fields may be set to different values.
+Driver needs to record each short GI support field for
+each bandwidth, and send correct info depends on current
+bandwidth to the WiFi firmware.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Tsang-Shian Lin <thlin@realtek.com>
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200717064937.27966-3-yhchuang@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 0eefafc51c62e..665d4bbdee6a0 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -722,8 +722,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ stbc_en = VHT_STBC_EN;
+ if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC)
+ ldpc_en = VHT_LDPC_EN;
+- if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
+- is_support_sgi = true;
+ } else if (sta->ht_cap.ht_supported) {
+ ra_mask |= (sta->ht_cap.mcs.rx_mask[1] << 20) |
+ (sta->ht_cap.mcs.rx_mask[0] << 12);
+@@ -731,9 +729,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ stbc_en = HT_STBC_EN;
+ if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
+ ldpc_en = HT_LDPC_EN;
+- if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20 ||
+- sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
+- is_support_sgi = true;
+ }
+
+ if (efuse->hw_cap.nss == 1)
+@@ -775,12 +770,18 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ switch (sta->bandwidth) {
+ case IEEE80211_STA_RX_BW_80:
+ bw_mode = RTW_CHANNEL_WIDTH_80;
++ is_support_sgi = sta->vht_cap.vht_supported &&
++ (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80);
+ break;
+ case IEEE80211_STA_RX_BW_40:
+ bw_mode = RTW_CHANNEL_WIDTH_40;
++ is_support_sgi = sta->ht_cap.ht_supported &&
++ (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40);
+ break;
+ default:
+ bw_mode = RTW_CHANNEL_WIDTH_20;
++ is_support_sgi = sta->ht_cap.ht_supported &&
++ (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20);
+ break;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 62ba05a65333a85b1511a8b8290fc8331e100ba2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 18:53:23 +0200
+Subject: s390/bpf: Fix sign extension in branch_ku
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 7477d43be5b1448bc0d4c85cb185a0144cc080e1 ]
+
+Both signed and unsigned variants of BPF_JMP | BPF_K require
+sign-extending the immediate. JIT emits cgfi for the signed case,
+which is correct, and clgfi for the unsigned case, which is not
+correct: clgfi zero-extends the immediate.
+
+s390 does not provide an instruction that does sign-extension and
+unsigned comparison at the same time. Therefore, fix by first loading
+the sign-extended immediate into work register REG_1 and proceeding
+as if it's BPF_X.
+
+Fixes: 4e9b4a6883dd ("s390/bpf: Use relative long branches")
+Reported-by: Seth Forshee <seth.forshee@canonical.com>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Tested-by: Seth Forshee <seth.forshee@canonical.com>
+Link: https://lore.kernel.org/bpf/20200717165326.6786-3-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index f4242b894cf28..6b3d612948fba 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1417,21 +1417,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ }
+ break;
+ branch_ku:
+- is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
+- /* clfi or clgfi %dst,imm */
+- EMIT6_IMM(is_jmp32 ? 0xc20f0000 : 0xc20e0000,
+- dst_reg, imm);
+- if (!is_first_pass(jit) &&
+- can_use_rel(jit, addrs[i + off + 1])) {
+- /* brc mask,off */
+- EMIT4_PCREL_RIC(0xa7040000,
+- mask >> 12, addrs[i + off + 1]);
+- } else {
+- /* brcl mask,off */
+- EMIT6_PCREL_RILC(0xc0040000,
+- mask >> 12, addrs[i + off + 1]);
+- }
+- break;
++ /* lgfi %w1,imm (load sign extend imm) */
++ src_reg = REG_1;
++ EMIT6_IMM(0xc0010000, src_reg, imm);
++ goto branch_xu;
+ branch_xs:
+ is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
+ if (!is_first_pass(jit) &&
+--
+2.25.1
+
--- /dev/null
+From 8b85a4fb5d2e02147273259615666e48182dcf1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 18:53:25 +0200
+Subject: s390/bpf: Tolerate not converging code shrinking
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 1491b73311a15bb5beeab5d30e03bff761ef6c18 ]
+
+"BPF_MAXINSNS: Maximum possible literals" unnecessarily falls back to
+the interpreter because of failing sanity check in bpf_set_addr. The
+problem is that there are a lot of branches that can be shrunk, and
+doing so opens up the possibility to shrink even more. This process
+does not converge after 3 passes, causing code offsets to change during
+the codegen pass, which must never happen.
+
+Fix by inserting nops during codegen pass in order to preserve code
+offets.
+
+Fixes: 4e9b4a6883dd ("s390/bpf: Use relative long branches")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20200717165326.6786-5-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 6b8968f6e207d..a78c5b59e1ab6 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -489,6 +489,24 @@ static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth)
+ } while (re <= last);
+ }
+
++static void bpf_skip(struct bpf_jit *jit, int size)
++{
++ if (size >= 6 && !is_valid_rel(size)) {
++ /* brcl 0xf,size */
++ EMIT6_PCREL_RIL(0xc0f4000000, size);
++ size -= 6;
++ } else if (size >= 4 && is_valid_rel(size)) {
++ /* brc 0xf,size */
++ EMIT4_PCREL(0xa7f40000, size);
++ size -= 4;
++ }
++ while (size >= 2) {
++ /* bcr 0,%0 */
++ _EMIT2(0x0700);
++ size -= 2;
++ }
++}
++
+ /*
+ * Emit function prologue
+ *
+@@ -1503,7 +1521,14 @@ static bool bpf_is_new_addr_sane(struct bpf_jit *jit, int i)
+ */
+ static int bpf_set_addr(struct bpf_jit *jit, int i)
+ {
+- if (!bpf_is_new_addr_sane(jit, i))
++ int delta;
++
++ if (is_codegen_pass(jit)) {
++ delta = jit->prg - jit->addrs[i];
++ if (delta < 0)
++ bpf_skip(jit, -delta);
++ }
++ if (WARN_ON_ONCE(!bpf_is_new_addr_sane(jit, i)))
+ return -1;
+ jit->addrs[i] = jit->prg;
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From aac1a78ef93a36428aac4810ff6364012c83e859 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 18:53:24 +0200
+Subject: s390/bpf: Use brcl for jumping to exit_ip if necessary
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 5fa6974471c5518a50bdd814067508dbcb477251 ]
+
+"BPF_MAXINSNS: Maximum possible literals" test causes panic with
+bpf_jit_harden = 2. The reason is that BPF_JMP | BPF_EXIT is always
+emitted as brc, however, after removal of JITed image size
+limitations, brcl might be required.
+
+Fix by using brcl when necessary.
+
+Fixes: 4e9b4a6883dd ("s390/bpf: Use relative long branches")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20200717165326.6786-4-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 6b3d612948fba..6b8968f6e207d 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1268,8 +1268,12 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ last = (i == fp->len - 1) ? 1 : 0;
+ if (last)
+ break;
+- /* j <exit> */
+- EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
++ if (!is_first_pass(jit) && can_use_rel(jit, jit->exit_ip))
++ /* brc 0xf, <exit> */
++ EMIT4_PCREL_RIC(0xa7040000, 0xf, jit->exit_ip);
++ else
++ /* brcl 0xf, <exit> */
++ EMIT6_PCREL_RILC(0xc0040000, 0xf, jit->exit_ip);
+ break;
+ /*
+ * Branch relative (number of skipped instructions) to offset on
+--
+2.25.1
+
--- /dev/null
+From 51544b500f0b76384f9a1e88f83cd26d021c8640 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 17:01:20 +0200
+Subject: s390/qeth: don't process empty bridge port events
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 02472e28b9a45471c6d8729ff2c7422baa9be46a ]
+
+Discard events that don't contain any entries. This shouldn't happen,
+but subsequent code relies on being able to use entry 0. So better
+be safe than accessing garbage.
+
+Fixes: b4d72c08b358 ("qeth: bridgeport support - basic control")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 2d3bca3c0141f..b4e06aeb6dc1c 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1142,6 +1142,10 @@ static void qeth_bridge_state_change(struct qeth_card *card,
+ int extrasize;
+
+ QETH_CARD_TEXT(card, 2, "brstchng");
++ if (qports->num_entries == 0) {
++ QETH_CARD_TEXT(card, 2, "BPempty");
++ return;
++ }
+ if (qports->entry_length != sizeof(struct qeth_sbp_port_entry)) {
+ QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length);
+ return;
+--
+2.25.1
+
--- /dev/null
+From 8ed9261c6fec522e38d2db814e08d47e382e63f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 17:01:18 +0200
+Subject: s390/qeth: tolerate pre-filled RX buffer
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit eff73e16ee116f6eafa2be48fab42659a27cb453 ]
+
+When preparing a buffer for RX refill, tolerate that it already has a
+pool_entry attached. Otherwise we could easily leak such a pool_entry
+when re-driving the RX refill after an error (from eg. do_qdio()).
+
+This needs some minor adjustment in the code that drains RX buffer(s)
+prior to RX refill and during teardown, so that ->pool_entry is NULLed
+accordingly.
+
+Fixes: 4a71df50047f ("qeth: new qeth device driver")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core_main.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 88e998de2d032..c8e57007c4238 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -204,12 +204,17 @@ EXPORT_SYMBOL_GPL(qeth_threads_running);
+ void qeth_clear_working_pool_list(struct qeth_card *card)
+ {
+ struct qeth_buffer_pool_entry *pool_entry, *tmp;
++ struct qeth_qdio_q *queue = card->qdio.in_q;
++ unsigned int i;
+
+ QETH_CARD_TEXT(card, 5, "clwrklst");
+ list_for_each_entry_safe(pool_entry, tmp,
+ &card->qdio.in_buf_pool.entry_list, list){
+ list_del(&pool_entry->list);
+ }
++
++ for (i = 0; i < ARRAY_SIZE(queue->bufs); i++)
++ queue->bufs[i].pool_entry = NULL;
+ }
+ EXPORT_SYMBOL_GPL(qeth_clear_working_pool_list);
+
+@@ -2951,7 +2956,7 @@ static struct qeth_buffer_pool_entry *qeth_find_free_buffer_pool_entry(
+ static int qeth_init_input_buffer(struct qeth_card *card,
+ struct qeth_qdio_buffer *buf)
+ {
+- struct qeth_buffer_pool_entry *pool_entry;
++ struct qeth_buffer_pool_entry *pool_entry = buf->pool_entry;
+ int i;
+
+ if ((card->options.cq == QETH_CQ_ENABLED) && (!buf->rx_skb)) {
+@@ -2962,9 +2967,13 @@ static int qeth_init_input_buffer(struct qeth_card *card,
+ return -ENOMEM;
+ }
+
+- pool_entry = qeth_find_free_buffer_pool_entry(card);
+- if (!pool_entry)
+- return -ENOBUFS;
++ if (!pool_entry) {
++ pool_entry = qeth_find_free_buffer_pool_entry(card);
++ if (!pool_entry)
++ return -ENOBUFS;
++
++ buf->pool_entry = pool_entry;
++ }
+
+ /*
+ * since the buffer is accessed only from the input_tasklet
+@@ -2972,8 +2981,6 @@ static int qeth_init_input_buffer(struct qeth_card *card,
+ * the QETH_IN_BUF_REQUEUE_THRESHOLD we should never run out off
+ * buffers
+ */
+-
+- buf->pool_entry = pool_entry;
+ for (i = 0; i < QETH_MAX_BUFFER_ELEMENTS(card); ++i) {
+ buf->buffer->element[i].length = PAGE_SIZE;
+ buf->buffer->element[i].addr =
+@@ -5802,6 +5809,7 @@ static unsigned int qeth_rx_poll(struct qeth_card *card, int budget)
+ if (done) {
+ QETH_CARD_STAT_INC(card, rx_bufs);
+ qeth_put_buffer_pool_entry(card, buffer->pool_entry);
++ buffer->pool_entry = NULL;
+ qeth_queue_input_buffer(card, card->rx.b_index);
+ card->rx.b_count--;
+
+--
+2.25.1
+
--- /dev/null
+From 15cf3a02455b10075e9c686b6c55278bc0e51875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 03:48:52 +0900
+Subject: samples: bpf: Fix bpf programs with kprobe/sys_connect event
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit af9bd3e3331b8af42b6606c75797d041ab39380c ]
+
+Currently, BPF programs with kprobe/sys_connect does not work properly.
+
+Commit 34745aed515c ("samples/bpf: fix kprobe attachment issue on x64")
+This commit modifies the bpf_load behavior of kprobe events in the x64
+architecture. If the current kprobe event target starts with "sys_*",
+add the prefix "__x64_" to the front of the event.
+
+Appending "__x64_" prefix with kprobe/sys_* event was appropriate as a
+solution to most of the problems caused by the commit below.
+
+ commit d5a00528b58c ("syscalls/core, syscalls/x86: Rename struct
+ pt_regs-based sys_*() to __x64_sys_*()")
+
+However, there is a problem with the sys_connect kprobe event that does
+not work properly. For __sys_connect event, parameters can be fetched
+normally, but for __x64_sys_connect, parameters cannot be fetched.
+
+ ffffffff818d3520 <__x64_sys_connect>:
+ ffffffff818d3520: e8 fb df 32 00 callq 0xffffffff81c01520
+ <__fentry__>
+ ffffffff818d3525: 48 8b 57 60 movq 96(%rdi), %rdx
+ ffffffff818d3529: 48 8b 77 68 movq 104(%rdi), %rsi
+ ffffffff818d352d: 48 8b 7f 70 movq 112(%rdi), %rdi
+ ffffffff818d3531: e8 1a ff ff ff callq 0xffffffff818d3450
+ <__sys_connect>
+ ffffffff818d3536: 48 98 cltq
+ ffffffff818d3538: c3 retq
+ ffffffff818d3539: 0f 1f 80 00 00 00 00 nopl (%rax)
+
+As the assembly code for __x64_sys_connect shows, parameters should be
+fetched and set into rdi, rsi, rdx registers prior to calling
+__sys_connect.
+
+Because of this problem, this commit fixes the sys_connect event by
+first getting the value of the rdi register and then the value of the
+rdi, rsi, and rdx register through an offset based on that value.
+
+Fixes: 34745aed515c ("samples/bpf: fix kprobe attachment issue on x64")
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200707184855.30968-2-danieltimlee@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/map_perf_test_kern.c | 9 ++++++---
+ samples/bpf/test_map_in_map_kern.c | 9 ++++++---
+ samples/bpf/test_probe_write_user_kern.c | 9 ++++++---
+ 3 files changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/samples/bpf/map_perf_test_kern.c b/samples/bpf/map_perf_test_kern.c
+index 12e91ae64d4d9..c9b31193ca128 100644
+--- a/samples/bpf/map_perf_test_kern.c
++++ b/samples/bpf/map_perf_test_kern.c
+@@ -11,6 +11,8 @@
+ #include <bpf/bpf_helpers.h>
+ #include "bpf_legacy.h"
+ #include <bpf/bpf_tracing.h>
++#include <bpf/bpf_core_read.h>
++#include "trace_common.h"
+
+ #define MAX_ENTRIES 1000
+ #define MAX_NR_CPUS 1024
+@@ -154,9 +156,10 @@ int stress_percpu_hmap_alloc(struct pt_regs *ctx)
+ return 0;
+ }
+
+-SEC("kprobe/sys_connect")
++SEC("kprobe/" SYSCALL(sys_connect))
+ int stress_lru_hmap_alloc(struct pt_regs *ctx)
+ {
++ struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);
+ char fmt[] = "Failed at stress_lru_hmap_alloc. ret:%dn";
+ union {
+ u16 dst6[8];
+@@ -175,8 +178,8 @@ int stress_lru_hmap_alloc(struct pt_regs *ctx)
+ long val = 1;
+ u32 key = 0;
+
+- in6 = (struct sockaddr_in6 *)PT_REGS_PARM2(ctx);
+- addrlen = (int)PT_REGS_PARM3(ctx);
++ in6 = (struct sockaddr_in6 *)PT_REGS_PARM2_CORE(real_regs);
++ addrlen = (int)PT_REGS_PARM3_CORE(real_regs);
+
+ if (addrlen != sizeof(*in6))
+ return 0;
+diff --git a/samples/bpf/test_map_in_map_kern.c b/samples/bpf/test_map_in_map_kern.c
+index 6cee61e8ce9b6..36a203e690645 100644
+--- a/samples/bpf/test_map_in_map_kern.c
++++ b/samples/bpf/test_map_in_map_kern.c
+@@ -13,6 +13,8 @@
+ #include <bpf/bpf_helpers.h>
+ #include "bpf_legacy.h"
+ #include <bpf/bpf_tracing.h>
++#include <bpf/bpf_core_read.h>
++#include "trace_common.h"
+
+ #define MAX_NR_PORTS 65536
+
+@@ -102,9 +104,10 @@ static __always_inline int do_inline_hash_lookup(void *inner_map, u32 port)
+ return result ? *result : -ENOENT;
+ }
+
+-SEC("kprobe/sys_connect")
++SEC("kprobe/" SYSCALL(sys_connect))
+ int trace_sys_connect(struct pt_regs *ctx)
+ {
++ struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);
+ struct sockaddr_in6 *in6;
+ u16 test_case, port, dst6[8];
+ int addrlen, ret, inline_ret, ret_key = 0;
+@@ -112,8 +115,8 @@ int trace_sys_connect(struct pt_regs *ctx)
+ void *outer_map, *inner_map;
+ bool inline_hash = false;
+
+- in6 = (struct sockaddr_in6 *)PT_REGS_PARM2(ctx);
+- addrlen = (int)PT_REGS_PARM3(ctx);
++ in6 = (struct sockaddr_in6 *)PT_REGS_PARM2_CORE(real_regs);
++ addrlen = (int)PT_REGS_PARM3_CORE(real_regs);
+
+ if (addrlen != sizeof(*in6))
+ return 0;
+diff --git a/samples/bpf/test_probe_write_user_kern.c b/samples/bpf/test_probe_write_user_kern.c
+index f033f36a13a38..fd651a65281eb 100644
+--- a/samples/bpf/test_probe_write_user_kern.c
++++ b/samples/bpf/test_probe_write_user_kern.c
+@@ -10,6 +10,8 @@
+ #include <linux/version.h>
+ #include <bpf/bpf_helpers.h>
+ #include <bpf/bpf_tracing.h>
++#include <bpf/bpf_core_read.h>
++#include "trace_common.h"
+
+ struct bpf_map_def SEC("maps") dnat_map = {
+ .type = BPF_MAP_TYPE_HASH,
+@@ -26,13 +28,14 @@ struct bpf_map_def SEC("maps") dnat_map = {
+ * This example sits on a syscall, and the syscall ABI is relatively stable
+ * of course, across platforms, and over time, the ABI may change.
+ */
+-SEC("kprobe/sys_connect")
++SEC("kprobe/" SYSCALL(sys_connect))
+ int bpf_prog1(struct pt_regs *ctx)
+ {
++ struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);
++ void *sockaddr_arg = (void *)PT_REGS_PARM2_CORE(real_regs);
++ int sockaddr_len = (int)PT_REGS_PARM3_CORE(real_regs);
+ struct sockaddr_in new_addr, orig_addr = {};
+ struct sockaddr_in *mapped_addr;
+- void *sockaddr_arg = (void *)PT_REGS_PARM2(ctx);
+- int sockaddr_len = (int)PT_REGS_PARM3(ctx);
+
+ if (sockaddr_len > sizeof(orig_addr))
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 9c0a242d1899f20a0b6b43f306e34abe2cbec88e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 23:09:36 +0800
+Subject: sched: correct SD_flags returned by tl->sd_flags()
+
+From: Peng Liu <iwtbavbm@gmail.com>
+
+[ Upstream commit 9b1b234bb86bcdcdb142e900d39b599185465dbb ]
+
+During sched domain init, we check whether non-topological SD_flags are
+returned by tl->sd_flags(), if found, fire a waning and correct the
+violation, but the code failed to correct the violation. Correct this.
+
+Fixes: 143e1e28cb40 ("sched: Rework sched_domain topology definition")
+Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
+Link: https://lkml.kernel.org/r/20200609150936.GA13060@iZj6chx1xj0e0buvshuecpZ
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index ba81187bb7af1..9079d865a9357 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1328,7 +1328,7 @@ sd_init(struct sched_domain_topology_level *tl,
+ sd_flags = (*tl->sd_flags)();
+ if (WARN_ONCE(sd_flags & ~TOPOLOGY_SD_FLAGS,
+ "wrong sd_flags in topology description\n"))
+- sd_flags &= ~TOPOLOGY_SD_FLAGS;
++ sd_flags &= TOPOLOGY_SD_FLAGS;
+
+ /* Apply detected topology flags */
+ sd_flags |= dflags;
+--
+2.25.1
+
--- /dev/null
+From 8b99c796254ab5799fb272cf4037a91de954eb40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 14:37:48 +0200
+Subject: sched/fair: Fix NOHZ next idle balance
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 3ea2f097b17e13a8280f1f9386c331b326a3dbef ]
+
+With commit:
+ 'b7031a02ec75 ("sched/fair: Add NOHZ_STATS_KICK")'
+rebalance_domains of the local cfs_rq happens before others idle cpus have
+updated nohz.next_balance and its value is overwritten.
+
+Move the update of nohz.next_balance for other idles cpus before balancing
+and updating the next_balance of local cfs_rq.
+
+Also, the nohz.next_balance is now updated only if all idle cpus got a
+chance to rebalance their domains and the idle balance has not been aborted
+because of new activities on the CPU. In case of need_resched, the idle
+load balance will be kick the next jiffie in order to address remaining
+ilb.
+
+Fixes: b7031a02ec75 ("sched/fair: Add NOHZ_STATS_KICK")
+Reported-by: Peng Liu <iwtbavbm@gmail.com>
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Link: https://lkml.kernel.org/r/20200609123748.18636-1-vincent.guittot@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 04fa8dbcfa4d7..6b3b59cc51d6c 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -10027,7 +10027,12 @@ static void kick_ilb(unsigned int flags)
+ {
+ int ilb_cpu;
+
+- nohz.next_balance++;
++ /*
++ * Increase nohz.next_balance only when if full ilb is triggered but
++ * not if we only update stats.
++ */
++ if (flags & NOHZ_BALANCE_KICK)
++ nohz.next_balance = jiffies+1;
+
+ ilb_cpu = find_new_ilb();
+
+@@ -10348,6 +10353,14 @@ static bool _nohz_idle_balance(struct rq *this_rq, unsigned int flags,
+ }
+ }
+
++ /*
++ * next_balance will be updated only when there is a need.
++ * When the CPU is attached to null domain for ex, it will not be
++ * updated.
++ */
++ if (likely(update_next_balance))
++ nohz.next_balance = next_balance;
++
+ /* Newly idle CPU doesn't need an update */
+ if (idle != CPU_NEWLY_IDLE) {
+ update_blocked_averages(this_cpu);
+@@ -10368,14 +10381,6 @@ static bool _nohz_idle_balance(struct rq *this_rq, unsigned int flags,
+ if (has_blocked_load)
+ WRITE_ONCE(nohz.has_blocked, 1);
+
+- /*
+- * next_balance will be updated only when there is a need.
+- * When the CPU is attached to null domain for ex, it will not be
+- * updated.
+- */
+- if (likely(update_next_balance))
+- nohz.next_balance = next_balance;
+-
+ return ret;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 385b25c5bbcc91f1edc5b3721c7e4f53034a5c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 12:21:22 +0100
+Subject: sched/uclamp: Fix initialization of struct uclamp_rq
+
+From: Qais Yousef <qais.yousef@arm.com>
+
+[ Upstream commit d81ae8aac85ca2e307d273f6dc7863a721bf054e ]
+
+struct uclamp_rq was zeroed out entirely in assumption that in the first
+call to uclamp_rq_inc() they'd be initialized correctly in accordance to
+default settings.
+
+But when next patch introduces a static key to skip
+uclamp_rq_{inc,dec}() until userspace opts in to use uclamp, schedutil
+will fail to perform any frequency changes because the
+rq->uclamp[UCLAMP_MAX].value is zeroed at init and stays as such. Which
+means all rqs are capped to 0 by default.
+
+Fix it by making sure we do proper initialization at init without
+relying on uclamp_rq_inc() doing it later.
+
+Fixes: 69842cba9ace ("sched/uclamp: Add CPU's clamp buckets refcounting")
+Signed-off-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
+Tested-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://lkml.kernel.org/r/20200630112123.12076-2-qais.yousef@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 2142c67676826..c3cbdc436e2e4 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1237,6 +1237,20 @@ static void uclamp_fork(struct task_struct *p)
+ }
+ }
+
++static void __init init_uclamp_rq(struct rq *rq)
++{
++ enum uclamp_id clamp_id;
++ struct uclamp_rq *uc_rq = rq->uclamp;
++
++ for_each_clamp_id(clamp_id) {
++ uc_rq[clamp_id] = (struct uclamp_rq) {
++ .value = uclamp_none(clamp_id)
++ };
++ }
++
++ rq->uclamp_flags = 0;
++}
++
+ static void __init init_uclamp(void)
+ {
+ struct uclamp_se uc_max = {};
+@@ -1245,11 +1259,8 @@ static void __init init_uclamp(void)
+
+ mutex_init(&uclamp_mutex);
+
+- for_each_possible_cpu(cpu) {
+- memset(&cpu_rq(cpu)->uclamp, 0,
+- sizeof(struct uclamp_rq)*UCLAMP_CNT);
+- cpu_rq(cpu)->uclamp_flags = 0;
+- }
++ for_each_possible_cpu(cpu)
++ init_uclamp_rq(cpu_rq(cpu));
+
+ for_each_clamp_id(clamp_id) {
+ uclamp_se_set(&init_task.uclamp_req[clamp_id],
+--
+2.25.1
+
--- /dev/null
+From 17a4188731d3d71f9e60cefa73f7e8c735de3077 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 15:22:16 -0400
+Subject: scripts/selinux/mdp: fix initial SID handling
+
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+
+[ Upstream commit 382c2b5d23b4245f1818f69286db334355488dc4 ]
+
+commit e3e0b582c321 ("selinux: remove unused initial SIDs and improve
+handling") broke scripts/selinux/mdp since the unused initial SID names
+were removed and the corresponding generation of policy initial SID
+definitions by mdp was not updated accordingly. Fix it. With latest
+upstream checkpolicy it is no longer necessary to include the SID context
+definitions for the unused initial SIDs but retain them for compatibility
+with older checkpolicy.
+
+Fixes: e3e0b582c321 ("selinux: remove unused initial SIDs and improve handling")
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/selinux/mdp/mdp.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c
+index 576d11a60417b..6ceb88eb9b590 100644
+--- a/scripts/selinux/mdp/mdp.c
++++ b/scripts/selinux/mdp/mdp.c
+@@ -67,8 +67,14 @@ int main(int argc, char *argv[])
+
+ initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
+ /* print out the sids */
+- for (i = 1; i < initial_sid_to_string_len; i++)
+- fprintf(fout, "sid %s\n", initial_sid_to_string[i]);
++ for (i = 1; i < initial_sid_to_string_len; i++) {
++ const char *name = initial_sid_to_string[i];
++
++ if (name)
++ fprintf(fout, "sid %s\n", name);
++ else
++ fprintf(fout, "sid unused%d\n", i);
++ }
+ fprintf(fout, "\n");
+
+ /* print out the class permissions */
+@@ -126,9 +132,16 @@ int main(int argc, char *argv[])
+ #define OBJUSERROLETYPE "user_u:object_r:base_t"
+
+ /* default sids */
+- for (i = 1; i < initial_sid_to_string_len; i++)
+- fprintf(fout, "sid %s " SUBJUSERROLETYPE "%s\n",
+- initial_sid_to_string[i], mls ? ":" SYSTEMLOW : "");
++ for (i = 1; i < initial_sid_to_string_len; i++) {
++ const char *name = initial_sid_to_string[i];
++
++ if (name)
++ fprintf(fout, "sid %s ", name);
++ else
++ fprintf(fout, "sid unused%d\n", i);
++ fprintf(fout, SUBJUSERROLETYPE "%s\n",
++ mls ? ":" SYSTEMLOW : "");
++ }
+ fprintf(fout, "\n");
+
+ #define FS_USE(behavior, fstype) \
+--
+2.25.1
+
--- /dev/null
+From 36b4fa679c586fe72a2dc4831695e28ad827b36d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 17:09:20 +0800
+Subject: scsi: core: Add missing scsi_device_put() in scsi_host_block()
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit f30785db7546520acd53aac7497d42352ff031e0 ]
+
+The scsi_host_block() case was missing in commit 4dea170f4fb2 ("scsi: core:
+Fix incorrect usage of shost_for_each_device").
+
+Link: https://lore.kernel.org/r/20200717090921.29243-1-yebin10@huawei.com
+Fixes: 2bb955840c1d ("scsi: core: add scsi_host_(block,unblock) helper function")
+Fixes: 4dea170f4fb2 ("scsi: core: Fix incorrect usage of shost_for_each_device")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_lib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 06056e9ec3335..ae620dada8ce5 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -2841,8 +2841,10 @@ scsi_host_block(struct Scsi_Host *shost)
+ mutex_lock(&sdev->state_mutex);
+ ret = scsi_internal_device_block_nowait(sdev);
+ mutex_unlock(&sdev->state_mutex);
+- if (ret)
++ if (ret) {
++ scsi_device_put(sdev);
+ break;
++ }
+ }
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From 1eced4313ba78c478d52792eef6ec04f9d64aecf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 22:47:30 +0200
+Subject: scsi: cumana_2: Fix different dev_id between request_irq() and
+ free_irq()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 040ab9c4fd0070cd5fa71ba3a7b95b8470db9b4d ]
+
+The dev_id used in request_irq() and free_irq() should match. Use 'info'
+in both cases.
+
+Link: https://lore.kernel.org/r/20200625204730.943520-1-christophe.jaillet@wanadoo.fr
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/arm/cumana_2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c
+index 65691c21f133d..29294f0ef8a9a 100644
+--- a/drivers/scsi/arm/cumana_2.c
++++ b/drivers/scsi/arm/cumana_2.c
+@@ -450,7 +450,7 @@ static int cumanascsi2_probe(struct expansion_card *ec,
+
+ if (info->info.scsi.dma != NO_DMA)
+ free_dma(info->info.scsi.dma);
+- free_irq(ec->irq, host);
++ free_irq(ec->irq, info);
+
+ out_release:
+ fas216_release(host);
+--
+2.25.1
+
--- /dev/null
+From 427b19b6858428045129158842a40a6e63109bea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 06:05:53 +0200
+Subject: scsi: eesox: Fix different dev_id between request_irq() and
+ free_irq()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 86f2da1112ccf744ad9068b1d5d9843faf8ddee6 ]
+
+The dev_id used in request_irq() and free_irq() should match. Use 'info' in
+both cases.
+
+Link: https://lore.kernel.org/r/20200626040553.944352-1-christophe.jaillet@wanadoo.fr
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/arm/eesox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c
+index 6e204a2e0c8d7..591ae2a6dd74f 100644
+--- a/drivers/scsi/arm/eesox.c
++++ b/drivers/scsi/arm/eesox.c
+@@ -571,7 +571,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id)
+
+ if (info->info.scsi.dma != NO_DMA)
+ free_dma(info->info.scsi.dma);
+- free_irq(ec->irq, host);
++ free_irq(ec->irq, info);
+
+ out_remove:
+ fas216_remove(host);
+--
+2.25.1
+
--- /dev/null
+From 771d18d8b97d798168210f2154d31e3d4e546343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 15:31:44 +0200
+Subject: scsi: megaraid_sas: Clear affinity hint
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit 1eb81df5c53b1e785fdef298d533feab991381e4 ]
+
+To avoid a warning in free_irq, clear the affinity hint.
+
+Link: https://lore.kernel.org/r/20200709133144.8363-1-thenzl@redhat.com
+Fixes: f0b9e7bdc309 ("scsi: megaraid_sas: Set affinity for high IOPS reply queues")
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 00668335c2afc..924ea9f4cdd09 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5602,9 +5602,13 @@ megasas_setup_irqs_msix(struct megasas_instance *instance, u8 is_probe)
+ &instance->irq_context[i])) {
+ dev_err(&instance->pdev->dev,
+ "Failed to register IRQ for vector %d.\n", i);
+- for (j = 0; j < i; j++)
++ for (j = 0; j < i; j++) {
++ if (j < instance->low_latency_index_start)
++ irq_set_affinity_hint(
++ pci_irq_vector(pdev, j), NULL);
+ free_irq(pci_irq_vector(pdev, j),
+ &instance->irq_context[j]);
++ }
+ /* Retry irq register for IO_APIC*/
+ instance->msix_vectors = 0;
+ instance->msix_load_balance = false;
+@@ -5642,6 +5646,9 @@ megasas_destroy_irqs(struct megasas_instance *instance) {
+
+ if (instance->msix_vectors)
+ for (i = 0; i < instance->msix_vectors; i++) {
++ if (i < instance->low_latency_index_start)
++ irq_set_affinity_hint(
++ pci_irq_vector(instance->pdev, i), NULL);
+ free_irq(pci_irq_vector(instance->pdev, i),
+ &instance->irq_context[i]);
+ }
+--
+2.25.1
+
--- /dev/null
+From b31c3ae43b7b12e4635b27b2229ae979e65ba525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 09:25:51 +1000
+Subject: scsi: mesh: Fix panic after host or bus reset
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit edd7dd2292ab9c3628b65c4d04514c3068ad54f6 ]
+
+Booting Linux with a Conner CP3200 drive attached to the MESH SCSI bus
+results in EH measures and a panic:
+
+[ 25.499838] mesh: configured for synchronous 5 MB/s
+[ 25.787154] mesh: performing initial bus reset...
+[ 29.867115] scsi host0: MESH
+[ 29.929527] mesh: target 0 synchronous at 3.6 MB/s
+[ 29.998763] scsi 0:0:0:0: Direct-Access CONNER CP3200-200mb-3.5 4040 PQ: 0 ANSI: 1 CCS
+[ 31.989975] sd 0:0:0:0: [sda] 415872 512-byte logical blocks: (213 MB/203 MiB)
+[ 32.070975] sd 0:0:0:0: [sda] Write Protect is off
+[ 32.137197] sd 0:0:0:0: [sda] Mode Sense: 5b 00 00 08
+[ 32.209661] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
+[ 32.332708] sda: [mac] sda1 sda2 sda3
+[ 32.417733] sd 0:0:0:0: [sda] Attached SCSI disk
+... snip ...
+[ 76.687067] mesh_abort((ptrval))
+[ 76.743606] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval)
+[ 76.810798] ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85
+[ 76.880720] dma stat=84e0 cmdptr=1f73d000
+[ 76.941387] phase=4 msgphase=0 conn_tgt=0 data_ptr=24576
+[ 77.005567] dma_st=1 dma_ct=0 n_msgout=0
+[ 77.065456] target 0: req=(ptrval) goes_out=0 saved_ptr=0
+[ 77.130512] mesh_abort((ptrval))
+[ 77.187670] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval)
+[ 77.255594] ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85
+[ 77.325778] dma stat=84e0 cmdptr=1f73d000
+[ 77.387239] phase=4 msgphase=0 conn_tgt=0 data_ptr=24576
+[ 77.453665] dma_st=1 dma_ct=0 n_msgout=0
+[ 77.515900] target 0: req=(ptrval) goes_out=0 saved_ptr=0
+[ 77.582902] mesh_host_reset
+[ 88.187083] Kernel panic - not syncing: mesh: double DMA start !
+[ 88.254510] CPU: 0 PID: 358 Comm: scsi_eh_0 Not tainted 5.6.13-pmac #1
+[ 88.323302] Call Trace:
+[ 88.378854] [e16ddc58] [c0027080] panic+0x13c/0x308 (unreliable)
+[ 88.446221] [e16ddcb8] [c02b2478] mesh_start.part.12+0x130/0x414
+[ 88.513298] [e16ddcf8] [c02b2fc8] mesh_queue+0x54/0x70
+[ 88.577097] [e16ddd18] [c02a1848] scsi_send_eh_cmnd+0x374/0x384
+[ 88.643476] [e16dddc8] [c02a1938] scsi_eh_tur+0x5c/0xb8
+[ 88.707878] [e16dddf8] [c02a1ab8] scsi_eh_test_devices+0x124/0x178
+[ 88.775663] [e16dde28] [c02a2094] scsi_eh_ready_devs+0x588/0x8a8
+[ 88.843124] [e16dde98] [c02a31d8] scsi_error_handler+0x344/0x520
+[ 88.910697] [e16ddf08] [c00409c8] kthread+0xe4/0xe8
+[ 88.975166] [e16ddf38] [c000f234] ret_from_kernel_thread+0x14/0x1c
+[ 89.044112] Rebooting in 180 seconds..
+
+In theory, a panic can happen after a bus or host reset with dma_started
+flag set. Fix this by halting the DMA before reinitializing the host.
+Don't assume that ms->current_req is set when halt_dma() is invoked as it
+may not hold for bus or host reset.
+
+BTW, this particular Conner drive can be made to work by inhibiting
+disconnect/reselect with 'mesh.resel_targets=0'.
+
+Link: https://lore.kernel.org/r/3952bc691e150a7128b29120999b6092071b039a.1595460351.git.fthain@telegraphics.com.au
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: Paul Mackerras <paulus@ozlabs.org>
+Reported-and-tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mesh.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
+index f9f8f4921654f..fd1d030640797 100644
+--- a/drivers/scsi/mesh.c
++++ b/drivers/scsi/mesh.c
+@@ -1045,6 +1045,8 @@ static void handle_error(struct mesh_state *ms)
+ while ((in_8(&mr->bus_status1) & BS1_RST) != 0)
+ udelay(1);
+ printk("done\n");
++ if (ms->dma_started)
++ halt_dma(ms);
+ handle_reset(ms);
+ /* request_q is empty, no point in mesh_start() */
+ return;
+@@ -1357,7 +1359,8 @@ static void halt_dma(struct mesh_state *ms)
+ ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd),
+ ms->tgts[ms->conn_tgt].data_goes_out);
+ }
+- scsi_dma_unmap(cmd);
++ if (cmd)
++ scsi_dma_unmap(cmd);
+ ms->dma_started = 0;
+ }
+
+@@ -1712,6 +1715,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd)
+
+ spin_lock_irqsave(ms->host->host_lock, flags);
+
++ if (ms->dma_started)
++ halt_dma(ms);
++
+ /* Reset the controller & dbdma channel */
+ out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16); /* stop dma */
+ out_8(&mr->exception, 0xff); /* clear all exception bits */
+--
+2.25.1
+
--- /dev/null
+From e33e01cf565a29f7d102946e0a89eb744cf167e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 05:59:48 +0200
+Subject: scsi: powertec: Fix different dev_id between request_irq() and
+ free_irq()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d179f7c763241c1dc5077fca88ddc3c47d21b763 ]
+
+The dev_id used in request_irq() and free_irq() should match. Use 'info' in
+both cases.
+
+Link: https://lore.kernel.org/r/20200626035948.944148-1-christophe.jaillet@wanadoo.fr
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/arm/powertec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c
+index 772a13e5fd916..d99ef014528e3 100644
+--- a/drivers/scsi/arm/powertec.c
++++ b/drivers/scsi/arm/powertec.c
+@@ -378,7 +378,7 @@ static int powertecscsi_probe(struct expansion_card *ec,
+
+ if (info->info.scsi.dma != NO_DMA)
+ free_dma(info->info.scsi.dma);
+- free_irq(ec->irq, host);
++ free_irq(ec->irq, info);
+
+ out_release:
+ fas216_release(host);
+--
+2.25.1
+
--- /dev/null
+From b4176eb32bd383086ed6dee97a9d35b26d26d5e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 15:54:51 -0700
+Subject: scsi: qla2xxx: Make __qla2x00_alloc_iocbs() initialize 32 bits of
+ request_t.handle
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit f8f12bda53eae87ca2dea42b36d19e48c9851b9f ]
+
+The request_t 'handle' member is 32-bits wide, hence use wrt_reg_dword().
+Change the cast in the wrt_reg_byte() call to make it clear that a regular
+pointer is casted to an __iomem pointer.
+
+Note: 'pkt' points to I/O memory for the qlafx00 adapter family and to
+coherent memory for all other adapter families.
+
+This patch fixes the following Coverity complaint:
+
+CID 358864 (#1 of 1): Reliance on integer endianness (INCOMPATIBLE_CAST)
+incompatible_cast: Pointer &pkt->handle points to an object whose effective
+type is unsigned int (32 bits, unsigned) but is dereferenced as a narrower
+unsigned short (16 bits, unsigned). This may lead to unexpected results
+depending on machine endianness.
+
+Link: https://lore.kernel.org/r/20200629225454.22863-7-bvanassche@acm.org
+Fixes: 8ae6d9c7eb10 ("[SCSI] qla2xxx: Enhancements to support ISPFx00.")
+Cc: Nilesh Javali <njavali@marvell.com>
+Cc: Quinn Tran <qutran@marvell.com>
+Cc: Himanshu Madhani <himanshu.madhani@oracle.com>
+Cc: Martin Wilck <mwilck@suse.com>
+Cc: Roman Bolshakov <r.bolshakov@yadro.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_iocb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 8865c35d34211..7c2ad8c18398c 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -2305,8 +2305,8 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp)
+ pkt = req->ring_ptr;
+ memset(pkt, 0, REQUEST_ENTRY_SIZE);
+ if (IS_QLAFX00(ha)) {
+- wrt_reg_byte((void __iomem *)&pkt->entry_count, req_cnt);
+- wrt_reg_word((void __iomem *)&pkt->handle, handle);
++ wrt_reg_byte((u8 __force __iomem *)&pkt->entry_count, req_cnt);
++ wrt_reg_dword((__le32 __force __iomem *)&pkt->handle, handle);
+ } else {
+ pkt->entry_count = req_cnt;
+ pkt->handle = handle;
+--
+2.25.1
+
--- /dev/null
+From 7f47c2b28982be80ff180df1ebc775a3443d866d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 20:23:19 +0800
+Subject: scsi: scsi_debug: Add check for sdebug_max_queue during module init
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit c87bf24cfb60bce27b4d2c7e56ebfd86fb9d16bb ]
+
+sdebug_max_queue should not exceed SDEBUG_CANQUEUE, otherwise crashes like
+this can be triggered by passing an out-of-range value:
+
+Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019
+ pstate: 20400009 (nzCv daif +PAN -UAO BTYPE=--)
+ pc : schedule_resp+0x2a4/0xa70 [scsi_debug]
+ lr : schedule_resp+0x52c/0xa70 [scsi_debug]
+ sp : ffff800022ab36f0
+ x29: ffff800022ab36f0 x28: ffff0023a935a610
+ x27: ffff800008e0a648 x26: 0000000000000003
+ x25: ffff0023e84f3200 x24: 00000000003d0900
+ x23: 0000000000000000 x22: 0000000000000000
+ x21: ffff0023be60a320 x20: ffff0023be60b538
+ x19: ffff800008e13000 x18: 0000000000000000
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: 0000000000000000 x14: 0000000000000000
+ x13: 0000000000000000 x12: 0000000000000000
+ x11: 0000000000000000 x10: 0000000000000000
+ x9 : 0000000000000001 x8 : 0000000000000000
+ x7 : 0000000000000000 x6 : 00000000000000c1
+ x5 : 0000020000200000 x4 : dead0000000000ff
+ x3 : 0000000000000200 x2 : 0000000000000200
+ x1 : ffff800008e13d88 x0 : 0000000000000000
+ Call trace:
+schedule_resp+0x2a4/0xa70 [scsi_debug]
+scsi_debug_queuecommand+0x2c4/0x9e0 [scsi_debug]
+scsi_queue_rq+0x698/0x840
+__blk_mq_try_issue_directly+0x108/0x228
+blk_mq_request_issue_directly+0x58/0x98
+blk_mq_try_issue_list_directly+0x5c/0xf0
+blk_mq_sched_insert_requests+0x18c/0x200
+blk_mq_flush_plug_list+0x11c/0x190
+blk_flush_plug_list+0xdc/0x110
+blk_finish_plug+0x38/0x210
+blkdev_direct_IO+0x450/0x4d8
+generic_file_read_iter+0x84/0x180
+blkdev_read_iter+0x3c/0x50
+aio_read+0xc0/0x170
+io_submit_one+0x5c8/0xc98
+__arm64_sys_io_submit+0x1b0/0x258
+el0_svc_common.constprop.3+0x68/0x170
+do_el0_svc+0x24/0x90
+el0_sync_handler+0x13c/0x1a8
+el0_sync+0x158/0x180
+ Code: 528847e0 72a001e0 6b00003f 540018cd (3941c340)
+
+In addition, it should not be less than 1.
+
+So add checks for these, and fail the module init for those cases.
+
+[mkp: changed if condition to match error message]
+
+Link: https://lore.kernel.org/r/1594297400-24756-2-git-send-email-john.garry@huawei.com
+Fixes: c483739430f1 ("scsi_debug: add multiple queue support")
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_debug.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 843cccb38cb76..b0d93bf79978f 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -6610,6 +6610,12 @@ static int __init scsi_debug_init(void)
+ pr_err("submit_queues must be 1 or more\n");
+ return -EINVAL;
+ }
++
++ if ((sdebug_max_queue > SDEBUG_CANQUEUE) || (sdebug_max_queue < 1)) {
++ pr_err("max_queue must be in range [1, %d]\n", SDEBUG_CANQUEUE);
++ return -EINVAL;
++ }
++
+ sdebug_q_arr = kcalloc(submit_queues, sizeof(struct sdebug_queue),
+ GFP_KERNEL);
+ if (sdebug_q_arr == NULL)
+--
+2.25.1
+
--- /dev/null
+From 0199d7ebe5d8dfa94eb855ab34f8240c3868c0f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 11:04:30 +0800
+Subject: scsi: ufs: Disable WriteBooster capability for non-supported UFS
+ devices
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit a7f1e69d4974666ea40886ee4801aebb2729ea81 ]
+
+If a UFS device is not qualified to use WriteBooster, either due to wrong
+UFS version or device-specific quirks, then the capability in host shall be
+disabled to prevent any WriteBooster operations in the future.
+
+Link: https://lore.kernel.org/r/20200625030430.25048-1-stanley.chu@mediatek.com
+Fixes: 3d17b9b5ab11 ("scsi: ufs: Add write booster feature support")
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 35 +++++++++++++++++++----------------
+ 1 file changed, 19 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index ec93bec8e78d8..e412e43d23821 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6818,20 +6818,30 @@ static int ufshcd_scsi_add_wlus(struct ufs_hba *hba)
+
+ static void ufshcd_wb_probe(struct ufs_hba *hba, u8 *desc_buf)
+ {
++ struct ufs_dev_info *dev_info = &hba->dev_info;
+ u8 lun;
+ u32 d_lu_wb_buf_alloc;
+
+ if (!ufshcd_is_wb_allowed(hba))
+ return;
++ /*
++ * Probe WB only for UFS-2.2 and UFS-3.1 (and later) devices or
++ * UFS devices with quirk UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES
++ * enabled
++ */
++ if (!(dev_info->wspecversion >= 0x310 ||
++ dev_info->wspecversion == 0x220 ||
++ (hba->dev_quirks & UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES)))
++ goto wb_disabled;
+
+ if (hba->desc_size.dev_desc < DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP + 4)
+ goto wb_disabled;
+
+- hba->dev_info.d_ext_ufs_feature_sup =
++ dev_info->d_ext_ufs_feature_sup =
+ get_unaligned_be32(desc_buf +
+ DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP);
+
+- if (!(hba->dev_info.d_ext_ufs_feature_sup & UFS_DEV_WRITE_BOOSTER_SUP))
++ if (!(dev_info->d_ext_ufs_feature_sup & UFS_DEV_WRITE_BOOSTER_SUP))
+ goto wb_disabled;
+
+ /*
+@@ -6840,17 +6850,17 @@ static void ufshcd_wb_probe(struct ufs_hba *hba, u8 *desc_buf)
+ * a max of 1 lun would have wb buffer configured.
+ * Now only shared buffer mode is supported.
+ */
+- hba->dev_info.b_wb_buffer_type =
++ dev_info->b_wb_buffer_type =
+ desc_buf[DEVICE_DESC_PARAM_WB_TYPE];
+
+- hba->dev_info.b_presrv_uspc_en =
++ dev_info->b_presrv_uspc_en =
+ desc_buf[DEVICE_DESC_PARAM_WB_PRESRV_USRSPC_EN];
+
+- if (hba->dev_info.b_wb_buffer_type == WB_BUF_MODE_SHARED) {
+- hba->dev_info.d_wb_alloc_units =
++ if (dev_info->b_wb_buffer_type == WB_BUF_MODE_SHARED) {
++ dev_info->d_wb_alloc_units =
+ get_unaligned_be32(desc_buf +
+ DEVICE_DESC_PARAM_WB_SHARED_ALLOC_UNITS);
+- if (!hba->dev_info.d_wb_alloc_units)
++ if (!dev_info->d_wb_alloc_units)
+ goto wb_disabled;
+ } else {
+ for (lun = 0; lun < UFS_UPIU_MAX_WB_LUN_ID; lun++) {
+@@ -6861,7 +6871,7 @@ static void ufshcd_wb_probe(struct ufs_hba *hba, u8 *desc_buf)
+ (u8 *)&d_lu_wb_buf_alloc,
+ sizeof(d_lu_wb_buf_alloc));
+ if (d_lu_wb_buf_alloc) {
+- hba->dev_info.wb_dedicated_lu = lun;
++ dev_info->wb_dedicated_lu = lun;
+ break;
+ }
+ }
+@@ -6950,14 +6960,7 @@ static int ufs_get_device_desc(struct ufs_hba *hba)
+
+ ufs_fixup_device_setup(hba);
+
+- /*
+- * Probe WB only for UFS-3.1 devices or UFS devices with quirk
+- * UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES enabled
+- */
+- if (dev_info->wspecversion >= 0x310 ||
+- dev_info->wspecversion == 0x220 ||
+- (hba->dev_quirks & UFS_DEVICE_QUIRK_SUPPORT_EXTENDED_FEATURES))
+- ufshcd_wb_probe(hba, desc_buf);
++ ufshcd_wb_probe(hba, desc_buf);
+
+ /*
+ * ufshcd_read_string_desc returns size of the string
+--
+2.25.1
+
--- /dev/null
+From 36042a3e87804693ef5dcc9c2bb3e0c8ab273e29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jun 2020 18:10:43 +0800
+Subject: scsi: ufs: Fix imprecise load calculation in devfreq window
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit b1bf66d1d5a8fcb54f0e584db5d196ef015b5172 ]
+
+The UFS load calculation is based on "total_time" and "busy_time" in a
+devfreq window. However, the source of time is different for both
+parameters: "busy_time" is assigned from "jiffies" thus has different
+accuracy from "total_time" which is assigned from ktime_get().
+
+In addition, the time of window boundary is not exactly the same as the
+starting busy time in this window if UFS is actually busy in the beginning
+of the window. A similar accuracy error may also happen for the end of busy
+time in current window.
+
+To guarantee the precision of load calculation, we need to
+
+1. Align time accuracy of both devfreq_dev_status.total_time and
+ devfreq_dev_status.busy_time. For example, use "ktime_get()" directly.
+
+2. Align the following timelines:
+ - The beginning time of devfreq windows
+ - The beginning of busy time in a new window
+ - The end of busy time in the current window
+
+Link: https://lore.kernel.org/r/20200611101043.6379-1-stanley.chu@mediatek.com
+Fixes: a3cd5ec55f6c ("scsi: ufs: add load based scaling of UFS gear")
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 18 ++++++++++--------
+ drivers/scsi/ufs/ufshcd.h | 2 +-
+ 2 files changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index a483c0720a0c1..ec93bec8e78d8 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1314,6 +1314,7 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev,
+ unsigned long flags;
+ struct list_head *clk_list = &hba->clk_list_head;
+ struct ufs_clk_info *clki;
++ ktime_t curr_t;
+
+ if (!ufshcd_is_clkscaling_supported(hba))
+ return -EINVAL;
+@@ -1321,6 +1322,7 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev,
+ memset(stat, 0, sizeof(*stat));
+
+ spin_lock_irqsave(hba->host->host_lock, flags);
++ curr_t = ktime_get();
+ if (!scaling->window_start_t)
+ goto start_window;
+
+@@ -1332,18 +1334,17 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev,
+ */
+ stat->current_frequency = clki->curr_freq;
+ if (scaling->is_busy_started)
+- scaling->tot_busy_t += ktime_to_us(ktime_sub(ktime_get(),
+- scaling->busy_start_t));
++ scaling->tot_busy_t += ktime_us_delta(curr_t,
++ scaling->busy_start_t);
+
+- stat->total_time = jiffies_to_usecs((long)jiffies -
+- (long)scaling->window_start_t);
++ stat->total_time = ktime_us_delta(curr_t, scaling->window_start_t);
+ stat->busy_time = scaling->tot_busy_t;
+ start_window:
+- scaling->window_start_t = jiffies;
++ scaling->window_start_t = curr_t;
+ scaling->tot_busy_t = 0;
+
+ if (hba->outstanding_reqs) {
+- scaling->busy_start_t = ktime_get();
++ scaling->busy_start_t = curr_t;
+ scaling->is_busy_started = true;
+ } else {
+ scaling->busy_start_t = 0;
+@@ -1877,6 +1878,7 @@ static void ufshcd_exit_clk_gating(struct ufs_hba *hba)
+ static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba)
+ {
+ bool queue_resume_work = false;
++ ktime_t curr_t = ktime_get();
+
+ if (!ufshcd_is_clkscaling_supported(hba))
+ return;
+@@ -1892,13 +1894,13 @@ static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba)
+ &hba->clk_scaling.resume_work);
+
+ if (!hba->clk_scaling.window_start_t) {
+- hba->clk_scaling.window_start_t = jiffies;
++ hba->clk_scaling.window_start_t = curr_t;
+ hba->clk_scaling.tot_busy_t = 0;
+ hba->clk_scaling.is_busy_started = false;
+ }
+
+ if (!hba->clk_scaling.is_busy_started) {
+- hba->clk_scaling.busy_start_t = ktime_get();
++ hba->clk_scaling.busy_start_t = curr_t;
+ hba->clk_scaling.is_busy_started = true;
+ }
+ }
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index bf97d616e597c..16187be98a94c 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -411,7 +411,7 @@ struct ufs_saved_pwr_info {
+ struct ufs_clk_scaling {
+ int active_reqs;
+ unsigned long tot_busy_t;
+- unsigned long window_start_t;
++ ktime_t window_start_t;
+ ktime_t busy_start_t;
+ struct device_attribute enable_attr;
+ struct ufs_saved_pwr_info saved_pwr_info;
+--
+2.25.1
+
--- /dev/null
+From cfb633a5a0c7a831ea3c618533152b77dafa5dbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 15:42:46 -0700
+Subject: seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 47e33c05f9f07cac3de833e531bcac9ae052c7ca ]
+
+When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced it had the wrong
+direction flag set. While this isn't a big deal as nothing currently
+enforces these bits in the kernel, it should be defined correctly. Fix
+the define and provide support for the old command until it is no longer
+needed for backward compatibility.
+
+Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/seccomp.h | 3 ++-
+ kernel/seccomp.c | 9 +++++++++
+ tools/testing/selftests/seccomp/seccomp_bpf.c | 2 +-
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h
+index c1735455bc536..965290f7dcc28 100644
+--- a/include/uapi/linux/seccomp.h
++++ b/include/uapi/linux/seccomp.h
+@@ -123,5 +123,6 @@ struct seccomp_notif_resp {
+ #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif)
+ #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \
+ struct seccomp_notif_resp)
+-#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64)
++#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64)
++
+ #endif /* _UAPI_LINUX_SECCOMP_H */
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index d653d8426de90..c461ba9925136 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -42,6 +42,14 @@
+ #include <linux/uaccess.h>
+ #include <linux/anon_inodes.h>
+
++/*
++ * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the
++ * wrong direction flag in the ioctl number. This is the broken one,
++ * which the kernel needs to keep supporting until all userspaces stop
++ * using the wrong command number.
++ */
++#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64)
++
+ enum notify_state {
+ SECCOMP_NOTIFY_INIT,
+ SECCOMP_NOTIFY_SENT,
+@@ -1186,6 +1194,7 @@ static long seccomp_notify_ioctl(struct file *file, unsigned int cmd,
+ return seccomp_notify_recv(filter, buf);
+ case SECCOMP_IOCTL_NOTIF_SEND:
+ return seccomp_notify_send(filter, buf);
++ case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR:
+ case SECCOMP_IOCTL_NOTIF_ID_VALID:
+ return seccomp_notify_id_valid(filter, buf);
+ default:
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index 252140a525531..ccf276e138829 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -180,7 +180,7 @@ struct seccomp_metadata {
+ #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif)
+ #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \
+ struct seccomp_notif_resp)
+-#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64)
++#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64)
+
+ struct seccomp_notif {
+ __u64 id;
+--
+2.25.1
+
--- /dev/null
+From b995516face6b43714264b928f20c0b95f2aeee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 13:37:03 -0700
+Subject: selftests/lkdtm: Reset WARN_ONCE to avoid false negatives
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 4fccc8c0ff740e62343b6de38426a48b345b95f4 ]
+
+Since we expect to see warnings every time for many tests, just reset
+the WARN_ONCE flags each time the script runs.
+
+Fixes: 46d1a0f03d66 ("selftests/lkdtm: Add tests for LKDTM targets")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20200625203704.317097-4-keescook@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/lkdtm/run.sh | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/lkdtm/run.sh b/tools/testing/selftests/lkdtm/run.sh
+index ee64ff8df8f4d..8383eb89d88a9 100755
+--- a/tools/testing/selftests/lkdtm/run.sh
++++ b/tools/testing/selftests/lkdtm/run.sh
+@@ -8,6 +8,7 @@
+ #
+ set -e
+ TRIGGER=/sys/kernel/debug/provoke-crash/DIRECT
++CLEAR_ONCE=/sys/kernel/debug/clear_warn_once
+ KSELFTEST_SKIP_TEST=4
+
+ # Verify we have LKDTM available in the kernel.
+@@ -67,6 +68,11 @@ cleanup() {
+ }
+ trap cleanup EXIT
+
++# Reset WARN_ONCE counters so we trip it each time this runs.
++if [ -w $CLEAR_ONCE ] ; then
++ echo 1 > $CLEAR_ONCE
++fi
++
+ # Save existing dmesg so we can detect new content below
+ dmesg > "$DMESG"
+
+--
+2.25.1
+
--- /dev/null
+From fbe781747e0c542e7d100acc8834870ad995bf95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 04:40:45 -0400
+Subject: selftests/net: relax cpu affinity requirement in msg_zerocopy test
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit 16f6458f2478b55e2b628797bc81a4455045c74e ]
+
+The msg_zerocopy test pins the sender and receiver threads to separate
+cores to reduce variance between runs.
+
+But it hardcodes the cores and skips core 0, so it fails on machines
+with the selected cores offline, or simply fewer cores.
+
+The test mainly gives code coverage in automated runs. The throughput
+of zerocopy ('-z') and non-zerocopy runs is logged for manual
+inspection.
+
+Continue even when sched_setaffinity fails. Just log to warn anyone
+interpreting the data.
+
+Fixes: 07b65c5b31ce ("test: add msg_zerocopy test")
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/msg_zerocopy.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c
+index 4b02933cab8aa..bdc03a2097e85 100644
+--- a/tools/testing/selftests/net/msg_zerocopy.c
++++ b/tools/testing/selftests/net/msg_zerocopy.c
+@@ -125,9 +125,8 @@ static int do_setcpu(int cpu)
+ CPU_ZERO(&mask);
+ CPU_SET(cpu, &mask);
+ if (sched_setaffinity(0, sizeof(mask), &mask))
+- error(1, 0, "setaffinity %d", cpu);
+-
+- if (cfg_verbose)
++ fprintf(stderr, "cpu: unable to pin, may increase variance.\n");
++ else if (cfg_verbose)
+ fprintf(stderr, "cpu: %u\n", cpu);
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 700172ebb8115e2ae37afd67bf9e4bfc2e571c69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 13:44:23 +0530
+Subject: selftests/powerpc: Fix CPU affinity for child process
+
+From: Harish <harish@linux.ibm.com>
+
+[ Upstream commit 854eb5022be04f81e318765f089f41a57c8e5d83 ]
+
+On systems with large number of cpus, test fails trying to set
+affinity by calling sched_setaffinity() with smaller size for affinity
+mask. This patch fixes it by making sure that the size of allocated
+affinity mask is dependent on the number of CPUs as reported by
+get_nprocs().
+
+Fixes: 00b7ec5c9cf3 ("selftests/powerpc: Import Anton's context_switch2 benchmark")
+Reported-by: Shirisha Ganta <shiganta@in.ibm.com>
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Signed-off-by: Harish <harish@linux.ibm.com>
+Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+Reviewed-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200609081423.529664-1-harish@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../powerpc/benchmarks/context_switch.c | 21 ++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/benchmarks/context_switch.c b/tools/testing/selftests/powerpc/benchmarks/context_switch.c
+index a2e8c9da7fa53..d50cc05df4952 100644
+--- a/tools/testing/selftests/powerpc/benchmarks/context_switch.c
++++ b/tools/testing/selftests/powerpc/benchmarks/context_switch.c
+@@ -19,6 +19,7 @@
+ #include <limits.h>
+ #include <sys/time.h>
+ #include <sys/syscall.h>
++#include <sys/sysinfo.h>
+ #include <sys/types.h>
+ #include <sys/shm.h>
+ #include <linux/futex.h>
+@@ -104,8 +105,9 @@ static void start_thread_on(void *(*fn)(void *), void *arg, unsigned long cpu)
+
+ static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu)
+ {
+- int pid;
+- cpu_set_t cpuset;
++ int pid, ncpus;
++ cpu_set_t *cpuset;
++ size_t size;
+
+ pid = fork();
+ if (pid == -1) {
+@@ -116,14 +118,23 @@ static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu)
+ if (pid)
+ return;
+
+- CPU_ZERO(&cpuset);
+- CPU_SET(cpu, &cpuset);
++ ncpus = get_nprocs();
++ size = CPU_ALLOC_SIZE(ncpus);
++ cpuset = CPU_ALLOC(ncpus);
++ if (!cpuset) {
++ perror("malloc");
++ exit(1);
++ }
++ CPU_ZERO_S(size, cpuset);
++ CPU_SET_S(cpu, size, cpuset);
+
+- if (sched_setaffinity(0, sizeof(cpuset), &cpuset)) {
++ if (sched_setaffinity(0, size, cpuset)) {
+ perror("sched_setaffinity");
++ CPU_FREE(cpuset);
+ exit(1);
+ }
+
++ CPU_FREE(cpuset);
+ fn(arg);
+
+ exit(0);
+--
+2.25.1
+
--- /dev/null
+From 8d8fdc3696d81551e938998ca9a6c23f6e801be6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 10:38:46 +0530
+Subject: selftests/powerpc: Fix online CPU selection
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit dfa03fff86027e58c8dba5c03ae68150d4e513ad ]
+
+The size of the CPU affinity mask must be large enough for
+systems with a very large number of CPUs. Otherwise, tests
+which try to determine the first online CPU by calling
+sched_getaffinity() will fail. This makes sure that the size
+of the allocated affinity mask is dependent on the number of
+CPUs as reported by get_nprocs_conf().
+
+Fixes: 3752e453f6ba ("selftests/powerpc: Add tests of PMU EBBs")
+Reported-by: Shirisha Ganta <shiganta@in.ibm.com>
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/a408c4b8e9a23bb39b539417a21eb0ff47bb5127.1596084858.git.sandipan@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/utils.c | 37 +++++++++++++++++--------
+ 1 file changed, 25 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/utils.c b/tools/testing/selftests/powerpc/utils.c
+index 5ee0e98c48967..eb530e73e02c1 100644
+--- a/tools/testing/selftests/powerpc/utils.c
++++ b/tools/testing/selftests/powerpc/utils.c
+@@ -16,6 +16,7 @@
+ #include <string.h>
+ #include <sys/ioctl.h>
+ #include <sys/stat.h>
++#include <sys/sysinfo.h>
+ #include <sys/types.h>
+ #include <sys/utsname.h>
+ #include <unistd.h>
+@@ -88,28 +89,40 @@ void *get_auxv_entry(int type)
+
+ int pick_online_cpu(void)
+ {
+- cpu_set_t mask;
+- int cpu;
++ int ncpus, cpu = -1;
++ cpu_set_t *mask;
++ size_t size;
++
++ ncpus = get_nprocs_conf();
++ size = CPU_ALLOC_SIZE(ncpus);
++ mask = CPU_ALLOC(ncpus);
++ if (!mask) {
++ perror("malloc");
++ return -1;
++ }
+
+- CPU_ZERO(&mask);
++ CPU_ZERO_S(size, mask);
+
+- if (sched_getaffinity(0, sizeof(mask), &mask)) {
++ if (sched_getaffinity(0, size, mask)) {
+ perror("sched_getaffinity");
+- return -1;
++ goto done;
+ }
+
+ /* We prefer a primary thread, but skip 0 */
+- for (cpu = 8; cpu < CPU_SETSIZE; cpu += 8)
+- if (CPU_ISSET(cpu, &mask))
+- return cpu;
++ for (cpu = 8; cpu < ncpus; cpu += 8)
++ if (CPU_ISSET_S(cpu, size, mask))
++ goto done;
+
+ /* Search for anything, but in reverse */
+- for (cpu = CPU_SETSIZE - 1; cpu >= 0; cpu--)
+- if (CPU_ISSET(cpu, &mask))
+- return cpu;
++ for (cpu = ncpus - 1; cpu >= 0; cpu--)
++ if (CPU_ISSET_S(cpu, size, mask))
++ goto done;
+
+ printf("No cpus in affinity mask?!\n");
+- return -1;
++
++done:
++ CPU_FREE(mask);
++ return cpu;
+ }
+
+ bool is_ppc64le(void)
+--
+2.25.1
+
--- /dev/null
+From a2b4469a51555a67d3ac6c8e4e1b90572156947f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 11:01:27 +1000
+Subject: selftests/powerpc: Squash spurious errors due to device removal
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 5f8cf6475828b600ff6d000e580c961ac839cc61 ]
+
+For drivers that don't have the error handling callbacks we implement
+recovery by removing the device and re-probing it. This causes the sysfs
+directory for the PCI device to be removed which causes the following
+spurious error to be printed when checking the PE state:
+
+Breaking 0005:03:00.0...
+./eeh-basic.sh: line 13: can't open /sys/bus/pci/devices/0005:03:00.0/eeh_pe_state: no such file
+0005:03:00.0, waited 0/60
+0005:03:00.0, waited 1/60
+0005:03:00.0, waited 2/60
+0005:03:00.0, waited 3/60
+0005:03:00.0, waited 4/60
+0005:03:00.0, waited 5/60
+0005:03:00.0, waited 6/60
+0005:03:00.0, waited 7/60
+0005:03:00.0, Recovered after 8 seconds
+
+We currently try to avoid this by checking if the PE state file exists
+before reading from it. This is however inherently racy so re-work the
+state checking so that we only read from the file once, and we squash any
+errors that occur while reading.
+
+Fixes: 85d86c8aa52e ("selftests/powerpc: Add basic EEH selftest")
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200727010127.23698-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/eeh/eeh-functions.sh | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
+index f52ed92b53e74..00dc32c0ed75c 100755
+--- a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
++++ b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
+@@ -5,12 +5,17 @@ pe_ok() {
+ local dev="$1"
+ local path="/sys/bus/pci/devices/$dev/eeh_pe_state"
+
+- if ! [ -e "$path" ] ; then
++ # if a driver doesn't support the error handling callbacks then the
++ # device is recovered by removing and re-probing it. This causes the
++ # sysfs directory to disappear so read the PE state once and squash
++ # any potential error messages
++ local eeh_state="$(cat $path 2>/dev/null)"
++ if [ -z "$eeh_state" ]; then
+ return 1;
+ fi
+
+- local fw_state="$(cut -d' ' -f1 < $path)"
+- local sw_state="$(cut -d' ' -f2 < $path)"
++ local fw_state="$(echo $eeh_state | cut -d' ' -f1)"
++ local sw_state="$(echo $eeh_state | cut -d' ' -f2)"
+
+ # If EEH_PE_ISOLATED or EEH_PE_RECOVERING are set then the PE is in an
+ # error state or being recovered. Either way, not ok.
+--
+2.25.1
+
kunit-capture-stderr-on-all-make-subprocess-calls.patch
io_uring-abstract-out-task-work-running.patch
hid-input-fix-devices-that-return-multiple-bytes-in-battery-report.patch
+arm-dts-stm32-fix-uart-nodes-ordering-in-stm32mp15-p.patch
+arm-dts-stm32-fix-uart7_pins_a-comments-in-stm32mp15.patch
+x86-mce-inject-fix-a-wrong-assignment-of-i_mce.statu.patch
+perf-x86-intel-uncore-fix-oops-when-counting-imc-unc.patch
+x86-sched-check-for-counters-overflow-in-frequency-i.patch
+x86-sched-bail-out-of-frequency-invariance-if-turbo-.patch
+x86-sched-bail-out-of-frequency-invariance-if-turbo_.patch
+sched-fair-fix-nohz-next-idle-balance.patch
+sched-correct-sd_flags-returned-by-tl-sd_flags.patch
+arm64-dts-rockchip-fix-rk3368-lion-gmac-reset-gpio.patch
+arm64-dts-rockchip-fix-rk3399-puma-vcc5v0-host-gpio.patch
+arm64-dts-rockchip-fix-rk3399-puma-gmac-reset-gpio.patch
+edac-fix-reference-count-leaks.patch
+crc-t10dif-fix-potential-crypto-notify-dead-lock.patch
+arm64-dts-qcom-msm8916-replace-invalid-bias-pull-non.patch
+memory-tegra-fix-an-error-handling-path-in-tegra186_.patch
+blktrace-fix-debugfs-use-after-free.patch
+soc-qcom-rpmh-rsc-don-t-use-ktime-for-timeout-in-wri.patch
+crypto-ccree-fix-resource-leak-on-error-path.patch
+arm-exynos-mcpm-restore-big.little-cpuidle-support.patch
+rcu-tree-repeat-the-monitor-if-any-free-channel-is-b.patch
+firmware-arm_scmi-fix-scmi-genpd-domain-probing.patch
+arm64-dts-sun50i-pinephone-dldo4-must-not-be-1.8v.patch
+arm64-dts-exynos-fix-silent-hang-after-boot-on-espre.patch
+sched-uclamp-fix-initialization-of-struct-uclamp_rq.patch
+crypto-qat-allow-xts-requests-not-multiple-of-block.patch
+clk-scmi-fix-min-and-max-rate-when-registering-clock.patch
+m68k-mac-don-t-send-iop-message-until-channel-is-idl.patch
+m68k-mac-fix-iop-status-control-register-writes.patch
+platform-x86-intel-hid-fix-return-value-check-in-che.patch
+platform-x86-intel-vbtn-fix-return-value-check-in-ch.patch
+arm-dts-gose-fix-ports-node-name-for-adv7180.patch
+arm64-dts-renesas-fix-sd-card-emmc-interface-device-.patch
+arm-dts-gose-fix-ports-node-name-for-adv7612.patch
+arm-at91-pm-add-missing-put_device-call-in-at91_pm_s.patch
+arm-dts-exynos-disable-frequency-scaling-for-fsys-bu.patch
+reset-intel-fix-a-compile-warning-about-reg_offset-r.patch
+arm-dts-at91-sama5d3_xplained-change-phy-mode.patch
+arm-dts-sunxi-bananapi-m2-plus-v1.2-add-regulator-su.patch
+arm-dts-sunxi-bananapi-m2-plus-v1.2-fix-cpu-supply-v.patch
+arm-dts-stm32-fix-spi4-pins-in-stm32mp15-pinctrl.patch
+spi-dw-dma-fix-tx-dma-channel-working-too-fast.patch
+spi-lantiq-fix-rx-overflow-error-in-full-duplex-mode.patch
+crypto-x86-crc32c-fix-building-with-clang-ias.patch
+tpm-require-that-all-digests-are-present-in-tcg_pcr_.patch
+recordmcount-only-record-relocation-of-type-r_aarch6.patch
+regulator-fix-memory-leak-on-error-path-of-regulator.patch
+io_uring-fix-sq-array-offset-calculation.patch
+arm64-dts-meson-misc-fixups-for-w400-dtsi.patch
+arm64-dts-meson-fix-mmc0-tuning-error-on-khadas-vim3.patch
+soc-qcom-pdr-reorder-the-pd-state-indication-ack.patch
+spi-rockchip-fix-error-in-spi-slave-pio-read.patch
+arm-socfpga-pm-add-missing-put_device-call-in-socfpg.patch
+iocost-fix-check-condition-of-iocg-abs_vdebt.patch
+scripts-selinux-mdp-fix-initial-sid-handling.patch
+irqchip-ti-sci-inta-fix-return-value-about-devm_iore.patch
+seccomp-fix-ioctl-number-for-seccomp_ioctl_notif_id_.patch
+md-raid0-linear-fix-dereference-before-null-check-on.patch
+irqchip-loongson-htvec-fix-potential-resource-leak.patch
+irqchip-loongson-htvec-check-return-value-of-irq_dom.patch
+irqchip-loongson-pch-pic-check-return-value-of-irq_d.patch
+irqchip-loongson-liointc-fix-potential-dead-lock.patch
+kunit-tool-fix-broken-default-args-in-unit-tests.patch
+kunit-tool-fix-improper-treatment-of-file-location.patch
+irqchip-irq-bcm7038-l1-guard-uses-of-cpu_logical_map.patch
+irqchip-gic-v4.1-use-gfp_atomic-flag-in-allocate_vpe.patch
+nvme-tcp-fix-controller-reset-hang-during-traffic.patch
+nvme-rdma-fix-controller-reset-hang-during-traffic.patch
+nvme-multipath-fix-logic-for-non-optimized-paths.patch
+nvme-multipath-do-not-fall-back-to-__nvme_find_path-.patch
+irqchip-loongson-pch-pic-fix-the-misused-irq-flow-ha.patch
+block-don-t-do-revalidate-zones-on-invalid-devices.patch
+drm-tilcdc-fix-leak-null-ref-in-panel_connector_get_.patch
+soc-qcom-rpmh-rsc-set-suppress_bind_attrs-flag.patch
+net-mscc-ocelot-fix-encoding-destination-ports-into-.patch
+arm-exynos-clear-l310_aux_ctrl_full_line_zero-in-def.patch
+bluetooth-add-a-mutex-lock-to-avoid-uaf-in-do_enale_.patch
+loop-be-paranoid-on-exit-and-prevent-new-additions-r.patch
+io_uring-fix-req-work-corruption.patch
+fs-btrfs-add-cond_resched-for-try_release_extent_map.patch
+drm-amdgpu-avoid-dereferencing-a-null-pointer.patch
+drm-radeon-fix-reference-count-leaks-caused-by-pm_ru.patch
+crypto-aesni-fix-build-with-llvm_ias-1.patch
+video-fbdev-savage-fix-memory-leak-on-error-handling.patch
+video-fbdev-neofb-fix-memory-leak-in-neo_scan_monito.patch
+bus-ti-sysc-add-missing-quirk-flags-for-usb_host_hs.patch
+md-cluster-fix-wild-pointer-of-unlock_all_bitmaps.patch
+rtw88-8822ce-add-support-for-device-id-0xc82f.patch
+drm-nouveau-kms-nv50-fix-disabling-dithering.patch
+arm64-dts-hisilicon-hikey-fixes-to-comply-with-adi-a.patch
+drm-etnaviv-fix-ref-count-leak-via-pm_runtime_get_sy.patch
+ionic-rearrange-reset-and-bus-master-control.patch
+memory-samsung-exynos5422-dmc-do-not-ignore-return-c.patch
+drm-nouveau-fix-reference-count-leak-in-nouveau_debu.patch
+drm-nouveau-fix-multiple-instances-of-reference-coun.patch
+mmc-sdhci-cadence-do-not-use-hardware-tuning-for-sd-.patch
+btrfs-fix-lockdep-splat-from-btrfs_dump_space_info.patch
+usb-mtu3-clear-dual-mode-of-u3port-when-disable-devi.patch
+drm-msm-a6xx-fix-gpu-failure-after-system-resume.patch
+drm-msm-fix-a-null-pointer-access-in-msm_gem_shrinke.patch
+drm-debugfs-fix-plain-echo-to-connector-force-attrib.patch
+drm-radeon-disable-agp-by-default.patch
+net-phy-mscc-restore-the-base-page-in-vsc8514-8584_c.patch
+irqchip-irq-mtk-sysirq-replace-spinlock-with-raw_spi.patch
+mm-mmap.c-add-cond_resched-for-exit_mmap-cpu-stalls.patch
+drm-amd-display-improve-displayport-monitor-interop.patch
+drm-amdgpu-debugfs-fix-ref-count-leak-when-pm_runtim.patch
+drm-amdgpu-display-bail-early-in-dm_pp_get_static_cl.patch
+drm-amdgpu-display-properly-guard-the-calls-to-swsmu.patch
+drm-amd-display-allow-query-ddc-data-over-aux-to-be-.patch
+drm-amd-powerplay-fix-compile-error-with-arch-arc.patch
+bpf-fix-fds_example-sigsegv-error.patch
+bluetooth-hci_qca-bug-fixes-for-ssr.patch
+brcmfmac-keep-sdio-watchdog-running-when-console_int.patch
+brcmfmac-to-fix-bss-info-flag-definition-bug.patch
+brcmfmac-set-state-of-hanger-slot-to-free-when-flush.patch
+platform-x86-asus-nb-wmi-add-support-for-asus-rog-ze.patch
+iwlegacy-check-the-return-value-of-pcie_capability_r.patch
+gpu-host1x-debug-fix-multiple-channels-emitting-mess.patch
+drm-amd-powerplay-suppress-compile-error-around-bug_.patch
+ionic-update-eid-test-for-overflow.patch
+x86-uaccess-make-__get_user_size-clang-compliant-on-.patch
+mmc-sdhci-pci-o2micro-bug-fix-for-o2-host-controller.patch
+usb-gadget-net2280-fix-memory-leak-on-probe-error-ha.patch
+bdc-fix-bug-causing-crash-after-multiple-disconnects.patch
+usb-bdc-halt-controller-on-suspend.patch
+dyndbg-fix-a-bug_on-in-ddebug_describe_flags.patch
+bcache-fix-super-block-seq-numbers-comparision-in-re.patch
+btrfs-allow-btrfs_truncate_block-to-fallback-to-noco.patch
+btrfs-qgroup-free-per-trans-reserved-space-when-a-su.patch
+acpica-do-not-increment-operation_region-reference-c.patch
+io_uring-fix-racy-overflow-count-reporting.patch
+io_uring-fix-stalled-deferred-requests.patch
+crypto-caam-silence-.setkey-in-case-of-bad-key-lengt.patch
+drm-msm-ratelimit-crtc-event-overflow-error.patch
+drm-gem-fix-a-leak-in-drm_gem_objects_lookup.patch
+drm-bridge-ti-sn65dsi86-clear-old-error-bits-before-.patch
+drm-bridge-ti-sn65dsi86-fix-off-by-one-error-in-cloc.patch
+drm-amdgpu-use-the-unlocked-drm_gem_object_put.patch
+agp-intel-fix-a-memory-leak-on-module-initialisation.patch
+mwifiex-fix-firmware-filename-for-sd8977-chipset.patch
+mwifiex-fix-firmware-filename-for-sd8997-chipset.patch
+btmrvl-fix-firmware-filename-for-sd8977-chipset.patch
+btmrvl-fix-firmware-filename-for-sd8997-chipset.patch
+video-fbdev-sm712fb-fix-an-issue-about-iounmap-for-a.patch
+console-newport_con-fix-an-issue-about-leak-related-.patch
+video-pxafb-fix-the-function-used-to-balance-a-dma_a.patch
+bluetooth-hci_qca-fix-an-error-pointer-dereference.patch
+drm-mm-fix-hole-size-comparison.patch
+bluetooth-hci_qca-only-remove-tx-clock-vote-after-tx.patch
+bluetooth-allow-suspend-even-when-preparation-has-fa.patch
+ath10k-acquire-tx_lock-in-tx-error-paths.patch
+bluetooth-hci_qca-bug-fix-during-ssr-timeout.patch
+bluetooth-hci_qca-increase-soc-idle-timeout-to-200ms.patch
+iio-improve-iio_concentration-channel-type-descripti.patch
+iio-amplifiers-ad8366-change-devm_gpiod_get-to-optio.patch
+scsi-ufs-fix-imprecise-load-calculation-in-devfreq-w.patch
+drm-etnaviv-fix-error-path-on-failure-to-enable-bus-.patch
+drm-panfrost-fix-inbalance-of-devfreq-record_busy-id.patch
+drm-arm-fix-unintentional-integer-overflow-on-left-s.patch
+clk-bcm63xx-gate-fix-last-clock-availability.patch
+powerpc-mm-fix-typo-in-is_enabled.patch
+powerpc-fixmap-fix-fix_early_debug_base-when-page-si.patch
+leds-lm355x-avoid-enum-conversion-warning.patch
+asoc-fsl_easrc-fix-uninitialized-scalar-variable-in-.patch
+bluetooth-btusb-fix-up-firmware-download-sequence.patch
+bluetooth-btmtksdio-fix-up-firmware-download-sequenc.patch
+media-cxusb-analog-fix-v4l2-dependency.patch
+media-marvell-ccic-add-missed-v4l2_async_notifier_cl.patch
+media-omap3isp-add-missed-v4l2_ctrl_handler_free-for.patch
+staging-most-avoid-null-pointer-dereference-when-ifa.patch
+dpaa2-eth-fix-condition-for-number-of-buffer-acquire.patch
+asoc-sof-nocodec-add-missing-.owner-field.patch
+asoc-intel-cml_rt1011_rt5682-add-missing-.owner-fiel.patch
+asoc-intel-sof_sdw-add-missing-.owner-field.patch
+asoc-intel-bxt_rt298-add-missing-.owner-field.patch
+asoc-intel-boards-cml_rt1011_rt5682-use-statically-d.patch
+net-atlantic-macsec-offload-statistics-checkpatch-fi.patch
+scsi-cumana_2-fix-different-dev_id-between-request_i.patch
+scsi-ufs-disable-writebooster-capability-for-non-sup.patch
+drm-mipi-use-dcs-write-for-mipi_dsi_dcs_set_tear_sca.patch
+cxl-fix-kobject-memleak.patch
+lkdtm-avoid-more-compiler-optimizations-for-bad-writ.patch
+selftests-lkdtm-reset-warn_once-to-avoid-false-negat.patch
+lkdtm-make-arch-specific-tests-always-available.patch
+net-ethernet-ti-am65-cpsw-nuss-restore-vlan-configur.patch
+tracing-move-pipe-reference-to-trace-array-instead-o.patch
+scsi-qla2xxx-make-__qla2x00_alloc_iocbs-initialize-3.patch
+drm-amdgpu-debugfs-fix-memory-leak-when-amdgpu_virt_.patch
+drm-amdgpu-ensure-0-is-returned-for-success-in-jpeg_.patch
+drm-radeon-fix-array-out-of-bounds-read-and-write-is.patch
+staging-vchiq_arm-add-a-matching-unregister-call.patch
+iavf-fix-error-return-code-in-iavf_init_get_resource.patch
+iavf-fix-updating-statistics.patch
+dma-buf-fix-dma-fence-chain-out-of-order-test.patch
+rdma-core-fix-bogus-warn_on-during-ib_unregister_dev.patch
+scsi-powertec-fix-different-dev_id-between-request_i.patch
+scsi-eesox-fix-different-dev_id-between-request_irq-.patch
+ipvs-allow-connection-reuse-for-unconfirmed-conntrac.patch
+media-firewire-using-uninitialized-values-in-node_pr.patch
+media-allegro-fix-some-null-vs-is_err-checks-in-prob.patch
+media-staging-rkisp1-rsz-supported-formats-are-the-i.patch
+media-staging-rkisp1-rsz-fix-resolution-limitation-o.patch
+media-tvp5150-add-missed-media_entity_cleanup.patch
+media-exynos4-is-add-missed-check-for-pinctrl_lookup.patch
+media-cros-ec-cec-do-not-bail-on-device_init_wakeup-.patch
+xfs-preserve-rmapbt-swapext-block-reservation-from-f.patch
+xfs-don-t-eat-an-eio-enospc-writeback-error-when-scr.patch
+xfs-fix-reflink-quota-reservation-accounting-error.patch
+iomap-make-sure-iomap_end-is-called-after-iomap_begi.patch
+rdma-rxe-skip-dgid-check-in-loopback-mode.patch
+pci-fix-pci_cfg_wait-queue-locking-problem.patch
+samples-bpf-fix-bpf-programs-with-kprobe-sys_connect.patch
+drm-stm-repair-runtime-power-management.patch
+kobject-avoid-premature-parent-object-freeing-in-kob.patch
+leds-core-flush-scheduled-work-for-system-suspend.patch
+drm-panel-simple-fix-bpc-for-lg-lb070wv8-panel.patch
+phy-cadence-salvo-fix-wrong-bit-definition.patch
+dt-bindings-phy-uniphier-fix-incorrect-clocks-and-cl.patch
+phy-exynos5-usbdrd-calibrating-makes-sense-only-for-.patch
+mmc-sdhci-of-arasan-add-missed-checks-for-devm_clk_r.patch
+drm-bridge-sil_sii8620-initialize-return-of-sii8620_.patch
+scsi-scsi_debug-add-check-for-sdebug_max_queue-durin.patch
+bpfilter-initialize-pos-variable.patch
+mwifiex-prevent-memory-corruption-handling-keys.patch
+kernfs-do-not-call-fsnotify-with-name-without-a-pare.patch
+powerpc-pseries-remove-cede-offline-state-for-cpus.patch
+powerpc-rtas-don-t-online-cpus-for-partition-suspend.patch
+powerpc-vdso-fix-vdso-cpu-truncation.patch
+bluetooth-fix-update-of-connection-state-in-hci_encr.patch
+rdma-qedr-srq-s-bug-fixes.patch
+rdma-qedr-add-edpm-mode-type-for-user-fw-compatibili.patch
+rdma-qedr-add-edpm-max-size-to-alloc-ucontext-respon.patch
+rdma-rxe-prevent-access-to-wr-next-ptr-afrer-wr-is-p.patch
+ima-have-the-lsm-free-its-audit-rule.patch
+ima-free-the-entire-rule-when-deleting-a-list-of-rul.patch
+ima-free-the-entire-rule-if-it-fails-to-parse.patch
+ima-fail-rule-parsing-when-buffer-hook-functions-hav.patch
+ima-fail-rule-parsing-when-the-kexec_cmdline-hook-is.patch
+ima-fail-rule-parsing-when-the-key_check-hook-is-com.patch
+staging-rtl8192u-fix-a-dubious-looking-mask-before-a.patch
+asoc-meson-fixes-the-missed-kfree-for-axg_card_add_t.patch
+pci-aspm-add-missing-newline-in-sysfs-policy.patch
+go7007-add-sanity-checking-for-endpoints.patch
+media-s5p-g2d-fix-a-memory-leak-in-an-error-handling.patch
+phy-renesas-rcar-gen3-usb2-move-irq-registration-to-.patch
+powerpc-mm-radix-free-pud-table-when-freeing-pagetab.patch
+powerpc-book3s64-pkeys-use-pvr-check-instead-of-cpu-.patch
+drm-imx-fix-use-after-free.patch
+drm-imx-tve-fix-regulator_disable-error-path.patch
+gpu-ipu-v3-restore-rgb32-bgr32.patch
+spi-lantiq-ssc-fix-warning-by-using-wq_mem_reclaim.patch
+pci-loongson-use-declare_pci_fixup_early-for-bridge_.patch
+usb-serial-iuu_phoenix-fix-led-activity-helpers.patch
+clk-qcom-gcc-make-disp-gpll0-branch-aon-for-sc7180-s.patch
+usb-core-fix-quirks_param_set-writing-to-a-const-poi.patch
+thermal-ti-soc-thermal-fix-reversed-condition-in-ti_.patch
+coresight-etmv4-fix-resource-selector-constant.patch
+coresight-etmv4-counter-values-not-saved-on-disable.patch
+coresight-tmc-fix-tmc-mode-read-in-tmc_read_unprepar.patch
+coresight-etm4x-fix-save-restore-during-cpu-idle.patch
+powerpc-perf-fix-missing-is_sier_aviable-during-buil.patch
+mt76-mt7663u-fix-memory-leak-in-set-key.patch
+mt76-mt7663u-fix-potential-memory-leak-in-mcu-messag.patch
+mt76-mt7615-fix-potential-memory-leak-in-mcu-message.patch
+mt76-mt7915-potential-array-overflow-in-mt7915_mcu_t.patch
+mt76-mt7915-add-missing-config_mac80211_debugfs.patch
+mt76-mt7615-fix-possible-memory-leak-in-mt7615_mcu_w.patch
+phy-armada-38x-fix-neta-lockup-when-repeatedly-switc.patch
+s390-bpf-fix-sign-extension-in-branch_ku.patch
+s390-bpf-use-brcl-for-jumping-to-exit_ip-if-necessar.patch
+s390-bpf-tolerate-not-converging-code-shrinking.patch
+tools-bpftool-fix-error-handing-in-do_skeleton.patch
+asoc-tas2770-fix-reset-gpio-property-name.patch
+qed-fix-ilt-and-xrcd-bitmap-memory-leaks.patch
+asoc-hdac_hda-fix-deadlock-after-pcm-open-error.patch
+powerpc-spufs-fix-the-type-of-ret-in-spufs_arch_writ.patch
+pci-rcar-fix-runtime-pm-imbalance-on-error.patch
+mips-octeon-add-missing-put_device-call-in-dwc3_octe.patch
+thermal-int340x-processor_thermal-fix-update-jasper-.patch
+usb-dwc3-meson-g12a-fix-shared-reset-control-use.patch
+usb-dwc2-fix-error-path-in-gadget-registration.patch
+usb-gadget-f_uac2-fix-ac-interface-header-descriptor.patch
+scsi-megaraid_sas-clear-affinity-hint.patch
+scsi-mesh-fix-panic-after-host-or-bus-reset.patch
+scsi-core-add-missing-scsi_device_put-in-scsi_host_b.patch
+net-dsa-mv88e6xxx-mv88e6097-does-not-support-jumbo-c.patch
+bpf-fix-pos-computation-for-bpf_iter-seq_ops-start.patch
+powerpc-watchpoint-fix-512-byte-boundary-limit.patch
+powerpc-watchpoint-fix-dawr-exception-constraint.patch
+powerpc-watchpoint-fix-dawr-exception-for-cacheop.patch
+macintosh-via-macii-access-autopoll_devs-when-inside.patch
+gpio-regmap-fix-type-clash.patch
+pci-hv-fix-a-timing-issue-which-causes-kdump-to-fail.patch
+pci-cadence-fix-cdns_pcie_-host-ep-_setup-error-path.patch
+pci-cadence-fix-updating-vendor-id-and-subsystem-ven.patch
+rdma-core-fix-return-error-value-in-_ib_modify_qp-to.patch
+smack-fix-another-vsscanf-out-of-bounds.patch
+smack-prevent-underflow-in-smk_set_cipso.patch
+power-supply-check-if-calc_soc-succeeded-in-pm860x_i.patch
+bluetooth-btusb-fix-and-detect-most-of-the-chinese-b.patch
+bluetooth-hci_h5-set-hci_uart_reset_on_init-to-corre.patch
+bluetooth-hci_serdev-only-unregister-device-if-it-wa.patch
+bpf-fix-bpf_ringbuf_output-signature-to-return-long.patch
+bluetooth-fix-suspend-notifier-race.patch
+bluetooth-hci_qca-stop-collecting-memdump-again-for-.patch
+net-dsa-rtl8366-fix-vlan-semantics.patch
+net-dsa-rtl8366-fix-vlan-set-up.patch
+xfs-fix-inode-allocation-block-res-calculation-prece.patch
+xfs-clear-xfs_dq_freeing-if-we-can-t-lock-the-dquot-.patch
+selftests-powerpc-squash-spurious-errors-due-to-devi.patch
+powerpc-32s-fix-config_book3s_601-uses.patch
+powerpc-boot-fix-config_ppc_mpc52xx-references.patch
+selftests-powerpc-fix-cpu-affinity-for-child-process.patch
+nvmem-sprd-fix-return-value-of-sprd_efuse_probe.patch
+rdma-rtrs-clt-add-an-additional-random-8-seconds-bef.patch
+rdma-rtrs-remove-wq_mem_reclaim-for-rtrs_wq.patch
+rdma-netlink-remove-cap_net_raw-check-when-dump-a-ra.patch
+pci-release-ivrs-table-in-amd-acs-quirk.patch
+cpufreq-ap806-fix-cpufreq-driver-needs-ap-cpu-clk.patch
+powerpc-pseries-hotplug-cpu-remove-double-free-in-er.patch
+selftests-powerpc-fix-online-cpu-selection.patch
+rdma-hns-fix-error-during-modify-qp-rts2rts.patch
+rdma-hns-fix-the-unneeded-process-when-getting-a-gen.patch
+asoc-meson-axg-tdm-interface-fix-link-fmt-setup.patch
+asoc-meson-axg-tdmin-fix-g12a-skew.patch
+asoc-meson-axg-tdm-formatters-fix-sclk-inversion.patch
+asoc-soc-core-fix-regression-causing-sysfs-entries-t.patch
+net-ll_temac-use-devm_platform_ioremap_resource_byna.patch
+drm-msm-dpu-don-t-use-intf_input_ctrl-feature-on-sdm.patch
+libbpf-fix-register-in-pt_regs-mips-macros.patch
+mips-only-register-ftlbpar-exception-handler-for-sup.patch
+asoc-core-use-less-strict-tests-for-dailink-capabili.patch
+asoc-meson-cards-deal-dpcm-flag-change.patch
+asoc-fsl_sai-fix-value-of-fsl_sai_cr1_rfw_mask.patch
+s390-qeth-tolerate-pre-filled-rx-buffer.patch
+s390-qeth-don-t-process-empty-bridge-port-events.patch
+ice-clear-and-free-xlt-entries-on-reset.patch
+ice-graceful-error-handling-in-hw-table-calloc-failu.patch
+netfilter-nft_meta-fix-iifgroup-matching.patch
+rtw88-fix-ldpc-field-for-ra-info.patch
+rtw88-fix-short-gi-capability-based-on-current-bandw.patch
+rtw88-coex-only-skip-coex-triggered-by-bt-info.patch
+qtnfmac-missing-platform_device_unregister-on-error-.patch
+wl1251-fix-always-return-0-error.patch
+tools-build-propagate-build-failures-from-tools-buil.patch
+tools-bpftool-fix-wrong-return-value-in-do_dump.patch
+net-mlx5-dr-change-push-vlan-action-sequence.patch
+net-mlx5-delete-extra-dump-stack-that-gives-nothing.patch
+ftrace-fix-ftrace_trace_task-return-value.patch
+net-mvpp2-fix-memory-leak-in-mvpp2_rx.patch
+net-ethernet-aquantia-fix-wrong-return-value.patch
+liquidio-fix-wrong-return-value-in-cn23xx_get_pf_num.patch
+net-sgi-ioc3-eth-fix-the-size-used-in-some-dma_free_.patch
+net-spider_net-fix-the-size-used-in-a-dma_free_coher.patch
+fsl-fman-use-32-bit-unsigned-integer.patch
+fsl-fman-fix-dereference-null-return-value.patch
+fsl-fman-fix-unreachable-code.patch
+fsl-fman-check-dereferencing-null-pointer.patch
+fsl-fman-fix-eth-hash-table-allocation.patch
+gpio-don-t-use-same-lockdep-class-for-all-devm_gpioc.patch
+net-thunderx-use-spin_lock_bh-in-nicvf_set_rx_mode_t.patch
+net-macb-properly-handle-phylink-on-at91sam9x.patch
+dpaa2-eth-fix-passing-zero-to-ptr_err-warning.patch
+hv_netvsc-do-not-use-vf-device-if-link-is-down.patch
+revert-vxlan-fix-tos-value-before-xmit.patch
+selftests-net-relax-cpu-affinity-requirement-in-msg_.patch
+net-thunderx-initialize-vf-s-mailbox-mutex-before-fi.patch
+media-mtk-mdp-fix-a-refcounting-bug-on-error-in-init.patch
+dlm-fix-kobject-memleak.patch
+ocfs2-fix-unbalanced-locking.patch
+pinctrl-single-fix-pcs_parse_pinconf-return-value.patch
+mtd-rawnand-brcmnand-don-t-default-to-edu-transfer.patch
+svcrdma-fix-page-leak-in-svc_rdma_recv_read_chunk.patch
+nfsd-avoid-a-null-dereference-in-__cld_pipe_upcall.patch
+sunrpc-fix-sunrpc-add-len-parameter-to-gss_unwrap.patch
--- /dev/null
+From ea1a34c8f76c670d3086ff84bde3c90410ad0168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 18:22:19 +0300
+Subject: Smack: fix another vsscanf out of bounds
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit a6bd4f6d9b07452b0b19842044a6c3ea384b0b88 ]
+
+This is similar to commit 84e99e58e8d1 ("Smack: slab-out-of-bounds in
+vsscanf") where we added a bounds check on "rule".
+
+Reported-by: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com
+Fixes: f7112e6c9abf ("Smack: allow for significantly longer Smack labels v4")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smackfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 840a192e93370..2bae1fc493d16 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -905,6 +905,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+
+ for (i = 0; i < catlen; i++) {
+ rule += SMK_DIGITLEN;
++ if (rule > data + count) {
++ rc = -EOVERFLOW;
++ goto out;
++ }
+ ret = sscanf(rule, "%u", &cat);
+ if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
+ goto out;
+--
+2.25.1
+
--- /dev/null
+From 0e61cf3b3b3a054d1a5cfb6be4d207032c1db917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 18:23:05 +0300
+Subject: Smack: prevent underflow in smk_set_cipso()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 42a2df3e829f3c5562090391b33714b2e2e5ad4a ]
+
+We have an upper bound on "maplevel" but forgot to check for negative
+values.
+
+Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smackfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 2bae1fc493d16..9c4308077574c 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -884,7 +884,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ }
+
+ ret = sscanf(rule, "%d", &maplevel);
+- if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
++ if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL)
+ goto out;
+
+ rule += SMK_DIGITLEN;
+--
+2.25.1
+
--- /dev/null
+From a777580e8a1a84c9f0d0f27fb6a270526f5b3dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 01:29:54 +0530
+Subject: soc: qcom: pdr: Reorder the PD state indication ack
+
+From: Sibi Sankar <sibis@codeaurora.org>
+
+[ Upstream commit 72fe996f9643043c8f84e32c0610975b01aa555b ]
+
+The Protection Domains (PD) have a mechanism to keep its resources
+enabled until the PD down indication is acked. Reorder the PD state
+indication ack so that clients get to release the relevant resources
+before the PD goes down.
+
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
+Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers")
+Reported-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
+Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20200701195954.9007-1-sibis@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/pdr_interface.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c
+index bdcf16f88a97f..4c9225f15c4e6 100644
+--- a/drivers/soc/qcom/pdr_interface.c
++++ b/drivers/soc/qcom/pdr_interface.c
+@@ -278,13 +278,15 @@ static void pdr_indack_work(struct work_struct *work)
+
+ list_for_each_entry_safe(ind, tmp, &pdr->indack_list, node) {
+ pds = ind->pds;
+- pdr_send_indack_msg(pdr, pds, ind->transaction_id);
+
+ mutex_lock(&pdr->status_lock);
+ pds->state = ind->curr_state;
+ pdr->status(pds->state, pds->service_path, pdr->priv);
+ mutex_unlock(&pdr->status_lock);
+
++ /* Ack the indication after clients release the PD resources */
++ pdr_send_indack_msg(pdr, pds, ind->transaction_id);
++
+ mutex_lock(&pdr->list_lock);
+ list_del(&ind->node);
+ mutex_unlock(&pdr->list_lock);
+--
+2.25.1
+
--- /dev/null
+From 7008d3993ba1d34f145f12c70e81b14cfea70418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 07:48:34 -0700
+Subject: soc: qcom: rpmh-rsc: Don't use ktime for timeout in
+ write_tcs_reg_sync()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit be24c6a71ecfbd9436ea1f496eb518a53e06368c ]
+
+The write_tcs_reg_sync() may be called after timekeeping is suspended
+so it's not OK to use ktime. The readl_poll_timeout_atomic() macro
+implicitly uses ktime. This was causing a warning at suspend time.
+
+Change to just loop 1000000 times with a delay of 1 us between loops.
+This may give a timeout of more than 1 second but never less and is
+safe even if timekeeping is suspended.
+
+NOTE: I don't have any actual evidence that we need to loop here.
+It's possibly that all we really need to do is just read the value
+back to ensure that the pipes are cleaned and the looping/comparing is
+totally not needed. I never saw the loop being needed in my tests.
+However, the loop shouldn't hurt.
+
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Maulik Shah <mkshah@codeaurora.org>
+Fixes: 91160150aba0 ("soc: qcom: rpmh-rsc: Timeout after 1 second in write_tcs_reg_sync()")
+Reported-by: Maulik Shah <mkshah@codeaurora.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20200528074530.1.Ib86e5b406fe7d16575ae1bb276d650faa144b63c@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 076fd27f3081c..906778e2c1fae 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -175,13 +175,21 @@ static void write_tcs_reg(const struct rsc_drv *drv, int reg, int tcs_id,
+ static void write_tcs_reg_sync(const struct rsc_drv *drv, int reg, int tcs_id,
+ u32 data)
+ {
+- u32 new_data;
++ int i;
+
+ writel(data, tcs_reg_addr(drv, reg, tcs_id));
+- if (readl_poll_timeout_atomic(tcs_reg_addr(drv, reg, tcs_id), new_data,
+- new_data == data, 1, USEC_PER_SEC))
+- pr_err("%s: error writing %#x to %d:%#x\n", drv->name,
+- data, tcs_id, reg);
++
++ /*
++ * Wait until we read back the same value. Use a counter rather than
++ * ktime for timeout since this may be called after timekeeping stops.
++ */
++ for (i = 0; i < USEC_PER_SEC; i++) {
++ if (readl(tcs_reg_addr(drv, reg, tcs_id)) == data)
++ return;
++ udelay(1);
++ }
++ pr_err("%s: error writing %#x to %d:%#x\n", drv->name,
++ data, tcs_id, reg);
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From 3913dac00bbb57a4672fbb656ee79290756b63fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 12:23:25 +0530
+Subject: soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag
+
+From: Maulik Shah <mkshah@codeaurora.org>
+
+[ Upstream commit 1a53ce9ab4faeb841b33d62d23283dc76c0e7c5a ]
+
+rpmh-rsc driver is fairly core to system and should not be removable
+once its probed. However it allows to unbind driver from sysfs using
+below command which results into a crash on sc7180.
+
+echo 18200000.rsc > /sys/bus/platform/drivers/rpmh/unbind
+
+Lets prevent unbind at runtime by setting suppress_bind_attrs flag.
+
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
+Link: https://lore.kernel.org/r/1592808805-2437-1-git-send-email-mkshah@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 906778e2c1fae..ae66757825813 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -1031,6 +1031,7 @@ static struct platform_driver rpmh_driver = {
+ .driver = {
+ .name = "rpmh",
+ .of_match_table = rpmh_drv_match,
++ .suppress_bind_attrs = true,
+ },
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 970337bcf5d36e5cf11a538e7691e793889b6747 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 23:39:51 +0300
+Subject: spi: dw-dma: Fix Tx DMA channel working too fast
+
+From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+
+[ Upstream commit affe93dd5b35bb0e7b0aa0505ae432dd0ac72c3f ]
+
+It turns out having a Rx DMA channel serviced with higher priority than
+a Tx DMA channel is not enough to provide a well balanced DMA-based SPI
+transfer interface. There might still be moments when the Tx DMA channel
+is occasionally handled faster than the Rx DMA channel. That in its turn
+will eventually cause the SPI Rx FIFO overflow if SPI bus speed is high
+enough to fill the SPI Rx FIFO in before it's cleared by the Rx DMA
+channel. That's why having the DMA-based SPI Tx interface too optimized
+is the errors prone, so the commit 0b2b66514fc9 ("spi: dw: Use DMA max
+burst to set the request thresholds") though being perfectly normal from
+the standard functionality point of view implicitly introduced the problem
+described above. In order to fix that the Tx DMA activity is intentionally
+slowed down by limiting the SPI Tx FIFO depth with a value twice bigger
+than the Tx burst length calculated earlier by the
+dw_spi_dma_maxburst_init() method.
+
+Fixes: 0b2b66514fc9 ("spi: dw: Use DMA max burst to set the request thresholds")
+Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Alexey Malahov <Alexey.Malahov@baikalelectronics.ru>
+Cc: Feng Tang <feng.tang@intel.com>
+Link: https://lore.kernel.org/r/20200721203951.2159-1-Sergey.Semin@baikalelectronics.ru
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-dw-dma.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-dw-dma.c b/drivers/spi/spi-dw-dma.c
+index 5986c520b1965..bb390ff67d1d8 100644
+--- a/drivers/spi/spi-dw-dma.c
++++ b/drivers/spi/spi-dw-dma.c
+@@ -372,8 +372,20 @@ static int dw_spi_dma_setup(struct dw_spi *dws, struct spi_transfer *xfer)
+ {
+ u16 imr = 0, dma_ctrl = 0;
+
++ /*
++ * Having a Rx DMA channel serviced with higher priority than a Tx DMA
++ * channel might not be enough to provide a well balanced DMA-based
++ * SPI transfer interface. There might still be moments when the Tx DMA
++ * channel is occasionally handled faster than the Rx DMA channel.
++ * That in its turn will eventually cause the SPI Rx FIFO overflow if
++ * SPI bus speed is high enough to fill the SPI Rx FIFO in before it's
++ * cleared by the Rx DMA channel. In order to fix the problem the Tx
++ * DMA activity is intentionally slowed down by limiting the SPI Tx
++ * FIFO depth with a value twice bigger than the Tx burst length
++ * calculated earlier by the dw_spi_dma_maxburst_init() method.
++ */
+ dw_writel(dws, DW_SPI_DMARDLR, dws->rxburst - 1);
+- dw_writel(dws, DW_SPI_DMATDLR, dws->fifo_len - dws->txburst);
++ dw_writel(dws, DW_SPI_DMATDLR, dws->txburst);
+
+ if (xfer->tx_buf)
+ dma_ctrl |= SPI_DMA_TDMAE;
+--
+2.25.1
+
--- /dev/null
+From 7de76e5e5a28c45a3b89e65e210b84a563d5177e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 14:27:50 +0800
+Subject: spi: lantiq: fix: Rx overflow error in full duplex mode
+
+From: Dilip Kota <eswara.kota@linux.intel.com>
+
+[ Upstream commit 661ccf2b3f1360be50242726f7c26ced6a9e7d52 ]
+
+In full duplex mode, rx overflow error is observed. To overcome the error,
+wait until the complete data got received and proceed further.
+
+Fixes: 17f84b793c01 ("spi: lantiq-ssc: add support for Lantiq SSC SPI controller")
+Signed-off-by: Dilip Kota <eswara.kota@linux.intel.com>
+Link: https://lore.kernel.org/r/efb650b0faa49a00788c4e0ca8ef7196bdba851d.1594957019.git.eswara.kota@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-lantiq-ssc.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/spi/spi-lantiq-ssc.c b/drivers/spi/spi-lantiq-ssc.c
+index 1fd7ee53d4510..44600fb71c484 100644
+--- a/drivers/spi/spi-lantiq-ssc.c
++++ b/drivers/spi/spi-lantiq-ssc.c
+@@ -184,6 +184,7 @@ struct lantiq_ssc_spi {
+ unsigned int tx_fifo_size;
+ unsigned int rx_fifo_size;
+ unsigned int base_cs;
++ unsigned int fdx_tx_level;
+ };
+
+ static u32 lantiq_ssc_readl(const struct lantiq_ssc_spi *spi, u32 reg)
+@@ -481,6 +482,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi)
+ u32 data;
+ unsigned int tx_free = tx_fifo_free(spi);
+
++ spi->fdx_tx_level = 0;
+ while (spi->tx_todo && tx_free) {
+ switch (spi->bits_per_word) {
+ case 2 ... 8:
+@@ -509,6 +511,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi)
+
+ lantiq_ssc_writel(spi, data, LTQ_SPI_TB);
+ tx_free--;
++ spi->fdx_tx_level++;
+ }
+ }
+
+@@ -520,6 +523,13 @@ static void rx_fifo_read_full_duplex(struct lantiq_ssc_spi *spi)
+ u32 data;
+ unsigned int rx_fill = rx_fifo_level(spi);
+
++ /*
++ * Wait until all expected data to be shifted in.
++ * Otherwise, rx overrun may occur.
++ */
++ while (rx_fill != spi->fdx_tx_level)
++ rx_fill = rx_fifo_level(spi);
++
+ while (rx_fill) {
+ data = lantiq_ssc_readl(spi, LTQ_SPI_RB);
+
+--
+2.25.1
+
--- /dev/null
+From baf08ba8f944a7c6d0c9658a7ae597c88c69c069 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 23:56:48 +0200
+Subject: spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+[ Upstream commit ba3548cf29616b58c93bbaffc3d636898d009858 ]
+
+The lantiq-ssc driver uses internally an own workqueue to wait till the
+data is not only written out of the FIFO but really written to the wire.
+This workqueue is flushed while the SPI subsystem is working in some
+other system workqueue.
+
+The system workqueue is marked as WQ_MEM_RECLAIM, but the workqueue in
+the lantiq-ssc driver does not use WQ_MEM_RECLAIM for now. Add this flag
+too to prevent this warning.
+
+This fixes the following warning:
+[ 2.975956] WARNING: CPU: 1 PID: 17 at kernel/workqueue.c:2614 check_flush_dependency+0x168/0x184
+[ 2.984752] workqueue: WQ_MEM_RECLAIM kblockd:blk_mq_run_work_fn is flushing !WQ_MEM_RECLAIM 1e100800.spi:0x0
+
+Fixes: 891b7c5fbf61 ("mtd_blkdevs: convert to blk-mq")
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Link: https://lore.kernel.org/r/20200717215648.20522-1-hauke@hauke-m.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-lantiq-ssc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-lantiq-ssc.c b/drivers/spi/spi-lantiq-ssc.c
+index 44600fb71c484..049a64451c750 100644
+--- a/drivers/spi/spi-lantiq-ssc.c
++++ b/drivers/spi/spi-lantiq-ssc.c
+@@ -909,7 +909,7 @@ static int lantiq_ssc_probe(struct platform_device *pdev)
+ master->bits_per_word_mask = SPI_BPW_RANGE_MASK(2, 8) |
+ SPI_BPW_MASK(16) | SPI_BPW_MASK(32);
+
+- spi->wq = alloc_ordered_workqueue(dev_name(dev), 0);
++ spi->wq = alloc_ordered_workqueue(dev_name(dev), WQ_MEM_RECLAIM);
+ if (!spi->wq) {
+ err = -ENOMEM;
+ goto err_clk_put;
+--
+2.25.1
+
--- /dev/null
+From 2df6343be03a33bea8525af9e417d9b6689e0cad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 08:43:56 +0800
+Subject: spi: rockchip: Fix error in SPI slave pio read
+
+From: Jon Lin <jon.lin@rock-chips.com>
+
+[ Upstream commit 4294e4accf8d695ea5605f6b189008b692e3e82c ]
+
+The RXFLR is possible larger than rx_left in Rockchip SPI, fix it.
+
+Fixes: 01b59ce5dac8 ("spi: rockchip: use irq rather than polling")
+Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
+Tested-by: Emil Renner Berthing <kernel@esmil.dk>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Emil Renner Berthing <kernel@esmil.dk>
+Link: https://lore.kernel.org/r/20200723004356.6390-3-jon.lin@rock-chips.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rockchip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 9b8a5e1233c06..4776aa815c3fa 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -288,7 +288,7 @@ static void rockchip_spi_pio_writer(struct rockchip_spi *rs)
+ static void rockchip_spi_pio_reader(struct rockchip_spi *rs)
+ {
+ u32 words = readl_relaxed(rs->regs + ROCKCHIP_SPI_RXFLR);
+- u32 rx_left = rs->rx_left - words;
++ u32 rx_left = (rs->rx_left > words) ? rs->rx_left - words : 0;
+
+ /* the hardware doesn't allow us to change fifo threshold
+ * level while spi is enabled, so instead make sure to leave
+--
+2.25.1
+
--- /dev/null
+From c6633e5e26f91371d2ea40e9218a05643def2aa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 17:39:57 +0100
+Subject: staging: most: avoid null pointer dereference when iface is null
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e4463e49e29f43eecec86e2e2b2e2ab4feb7d867 ]
+
+In the case where the pointer iface is null then the reporting of this
+error will dereference iface when printing an error message causing which
+is not ideal. Since the majority of callers to most_register_interface
+report an error when -EINVAL is returned a simple fix is to just remove
+the error message, I doubt it will be missed.
+
+Addresses-Coverity: ("Dereference after null check")
+Fixes: 57562a72414c ("Staging: most: add MOST driver's core module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20200624163957.11676-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/most/core.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/most/core.c b/drivers/most/core.c
+index f781c46cd4af9..353ab277cbc6b 100644
+--- a/drivers/most/core.c
++++ b/drivers/most/core.c
+@@ -1283,10 +1283,8 @@ int most_register_interface(struct most_interface *iface)
+ struct most_channel *c;
+
+ if (!iface || !iface->enqueue || !iface->configure ||
+- !iface->poison_channel || (iface->num_channels > MAX_CHANNELS)) {
+- dev_err(iface->dev, "Bad interface or channel overflow\n");
++ !iface->poison_channel || (iface->num_channels > MAX_CHANNELS))
+ return -EINVAL;
+- }
+
+ id = ida_simple_get(&mdev_id, 0, 0, GFP_KERNEL);
+ if (id < 0) {
+--
+2.25.1
+
--- /dev/null
+From 6d439f37367f001afb7b5aab5fc5440dbb7d962a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 16:47:20 +0100
+Subject: staging: rtl8192u: fix a dubious looking mask before a shift
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c4283950a9a4d3bf4a3f362e406c80ab14f10714 ]
+
+Currently the masking of ret with 0xff and followed by a right shift
+of 8 bits always leaves a zero result. It appears the mask of 0xff
+is incorrect and should be 0xff00, but I don't have the hardware to
+test this. Fix this to mask the upper 8 bits before shifting.
+
+[ Not tested ]
+
+Addresses-Coverity: ("Operands don't affect result")
+Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20200716154720.1710252-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192u/r8192U_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index fcfb9024a83f0..6ec65187bef91 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -2374,7 +2374,7 @@ static int rtl8192_read_eeprom_info(struct net_device *dev)
+ ret = eprom_read(dev, (EEPROM_TX_PW_INDEX_CCK >> 1));
+ if (ret < 0)
+ return ret;
+- priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff) >> 8;
++ priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff00) >> 8;
+ } else
+ priv->EEPROMTxPowerLevelCCK = 0x10;
+ RT_TRACE(COMP_EPROM, "CCK Tx Power Levl: 0x%02x\n", priv->EEPROMTxPowerLevelCCK);
+--
+2.25.1
+
--- /dev/null
+From bce3006f55638a7128340bac878f3f2236fbe379 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 17:09:06 +0200
+Subject: staging: vchiq_arm: Add a matching unregister call
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 5d9272e28a9a6117fb63f5f930991304765caa32 ]
+
+All the registered children of vchiq have a corresponding call to
+platform_device_unregister except bcm2835_audio. Fix that.
+
+Fixes: 25c7597af20d ("staging: vchiq_arm: Register a platform device for audio")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20200629150945.10720-9-nsaenzjulienne@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index 28ea8c3a4cba9..355590f1e130e 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -2805,6 +2805,7 @@ static int vchiq_probe(struct platform_device *pdev)
+
+ static int vchiq_remove(struct platform_device *pdev)
+ {
++ platform_device_unregister(bcm2835_audio);
+ platform_device_unregister(bcm2835_camera);
+ vchiq_debugfs_deinit();
+ device_destroy(vchiq_class, vchiq_devid);
+--
+2.25.1
+
--- /dev/null
+From 15ea10b7db464d4835dff0dacebc37cb192f2f4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 17:08:57 -0400
+Subject: SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()")
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 986a4b63d3bc5f2c0eb4083b05aff2bf883b7b2f ]
+
+Braino when converting "buf->len -=" to "buf->len = len -".
+
+The result is under-estimation of the ralign and rslack values. On
+krb5p mounts, this has caused READDIR to fail with EIO, and KASAN
+splats when decoding READLINK replies.
+
+As a result of fixing this oversight, the gss_unwrap method now
+returns a buf->len that can be shorter than priv_len for small
+RPC messages. The additional adjustment done in unwrap_priv_data()
+can underflow buf->len. This causes the nfsd_request_too_large
+check to fail during some NFSv3 operations.
+
+Reported-by: Marian Rainer-Harbach
+Reported-by: Pierre Sauter <pierre.sauter@stwm.de>
+BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1886277
+Fixes: 31c9590ae468 ("SUNRPC: Add "@len" parameter to gss_unwrap()")
+Reviewed-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/gss_krb5_wrap.c | 2 +-
+ net/sunrpc/auth_gss/svcauth_gss.c | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
+index cf0fd170ac189..90b8329fef824 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
+@@ -584,7 +584,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, int len,
+ buf->head[0].iov_len);
+ memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen);
+ buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
+- buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip;
++ buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
+
+ /* Trim off the trailing "extra count" and checksum blob */
+ xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 46027d0c903f9..c28051f7d217d 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -958,7 +958,6 @@ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gs
+
+ maj_stat = gss_unwrap(ctx, 0, priv_len, buf);
+ pad = priv_len - buf->len;
+- buf->len -= pad;
+ /* The upper layers assume the buffer is aligned on 4-byte boundaries.
+ * In the krb5p case, at least, the data ends up offset, so we need to
+ * move it around. */
+--
+2.25.1
+
--- /dev/null
+From 2e9cc15595f111d4d01d63c3a9a5b7fa14e276eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jun 2020 12:44:56 -0400
+Subject: svcrdma: Fix page leak in svc_rdma_recv_read_chunk()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit e814eecbe3bbeaa8b004d25a4b8974d232b765a9 ]
+
+Commit 07d0ff3b0cd2 ("svcrdma: Clean up Read chunk path") moved the
+page saver logic so that it gets executed event when an error occurs.
+In that case, the I/O is never posted, and those pages are then
+leaked. Errors in this path, however, are quite rare.
+
+Fixes: 07d0ff3b0cd2 ("svcrdma: Clean up Read chunk path")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/svc_rdma_rw.c | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
+index 5eb35309ecef1..83806fa94def5 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
+@@ -684,7 +684,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp,
+ struct svc_rdma_read_info *info,
+ __be32 *p)
+ {
+- unsigned int i;
+ int ret;
+
+ ret = -EINVAL;
+@@ -707,12 +706,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp,
+ info->ri_chunklen += rs_length;
+ }
+
+- /* Pages under I/O have been copied to head->rc_pages.
+- * Prevent their premature release by svc_xprt_release() .
+- */
+- for (i = 0; i < info->ri_readctxt->rc_page_count; i++)
+- rqstp->rq_pages[i] = NULL;
+-
+ return ret;
+ }
+
+@@ -807,6 +800,26 @@ static int svc_rdma_build_pz_read_chunk(struct svc_rqst *rqstp,
+ return ret;
+ }
+
++/* Pages under I/O have been copied to head->rc_pages. Ensure they
++ * are not released by svc_xprt_release() until the I/O is complete.
++ *
++ * This has to be done after all Read WRs are constructed to properly
++ * handle a page that is part of I/O on behalf of two different RDMA
++ * segments.
++ *
++ * Do this only if I/O has been posted. Otherwise, we do indeed want
++ * svc_xprt_release() to clean things up properly.
++ */
++static void svc_rdma_save_io_pages(struct svc_rqst *rqstp,
++ const unsigned int start,
++ const unsigned int num_pages)
++{
++ unsigned int i;
++
++ for (i = start; i < num_pages + start; i++)
++ rqstp->rq_pages[i] = NULL;
++}
++
+ /**
+ * svc_rdma_recv_read_chunk - Pull a Read chunk from the client
+ * @rdma: controlling RDMA transport
+@@ -860,6 +873,7 @@ int svc_rdma_recv_read_chunk(struct svcxprt_rdma *rdma, struct svc_rqst *rqstp,
+ ret = svc_rdma_post_chunk_ctxt(&info->ri_cc);
+ if (ret < 0)
+ goto out_err;
++ svc_rdma_save_io_pages(rqstp, 0, head->rc_page_count);
+ return 0;
+
+ out_err:
+--
+2.25.1
+
--- /dev/null
+From fcd90cba3b310d48e17bb92b98d4758763dc191d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 13:22:26 +0530
+Subject: thermal: int340x: processor_thermal: fix: update Jasper Lake PCI id
+
+From: Sumeet Pawnikar <sumeet.r.pawnikar@intel.com>
+
+[ Upstream commit 287d959558357e155c889bc35579eb35691a8fcb ]
+
+Update PCI device id for Jasper Lake processor thermal device.
+With this proc_thermal driver is getting loaded and processor
+thermal functionality works on Jasper Lake system.
+
+Fixes: f64a6583d3f5 ("thermal: int340x: processor_thermal: Add Jasper Lake support")
+Signed-off-by: Sumeet Pawnikar <sumeet.r.pawnikar@intel.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/1595577146-1221-1-git-send-email-sumeet.r.pawnikar@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../thermal/intel/int340x_thermal/processor_thermal_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+index 297db1d2d960c..81e8b15ef405d 100644
+--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+@@ -43,7 +43,7 @@
+ #define PCI_DEVICE_ID_PROC_ICL_THERMAL 0x8a03
+
+ /* JasperLake thermal reporting device */
+-#define PCI_DEVICE_ID_PROC_JSL_THERMAL 0x4503
++#define PCI_DEVICE_ID_PROC_JSL_THERMAL 0x4E03
+
+ /* TigerLake thermal reporting device */
+ #define PCI_DEVICE_ID_PROC_TGL_THERMAL 0x9A03
+--
+2.25.1
+
--- /dev/null
+From 046fd6570fc8e4e4168bd85a03e5da234cead923 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 12:19:49 +0300
+Subject: thermal: ti-soc-thermal: Fix reversed condition in
+ ti_thermal_expose_sensor()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0f348db01fdf128813fdd659fcc339038fb421a4 ]
+
+This condition is reversed and will cause breakage.
+
+Fixes: 7440f518dad9 ("thermal/drivers/ti-soc-thermal: Avoid dereferencing ERR_PTR")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200616091949.GA11940@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/ti-soc-thermal/ti-thermal-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+index 85776db4bf346..2ce4b19f312ac 100644
+--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
++++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+@@ -169,7 +169,7 @@ int ti_thermal_expose_sensor(struct ti_bandgap *bgp, int id,
+
+ data = ti_bandgap_get_sensor_data(bgp, id);
+
+- if (!IS_ERR_OR_NULL(data))
++ if (IS_ERR_OR_NULL(data))
+ data = ti_thermal_build_data(bgp, id);
+
+ if (!data)
+--
+2.25.1
+
--- /dev/null
+From 411ce3ddf3fd77a95784c6a4518a3aaef088ea81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 20:30:59 +0800
+Subject: tools/bpftool: Fix error handing in do_skeleton()
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 956fcfcd359512f15b19bcd157fa8206ed26605b ]
+
+Fix pass 0 to PTR_ERR, also dump more err info using
+libbpf_strerror.
+
+Fixes: 5dc7a8b21144 ("bpftool, selftests/bpf: Embed object file inside skeleton")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20200717123059.29624-1-yuehaibing@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/gen.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
+index 10de76b296ba1..540ffde0b03a3 100644
+--- a/tools/bpf/bpftool/gen.c
++++ b/tools/bpf/bpftool/gen.c
+@@ -305,8 +305,11 @@ static int do_skeleton(int argc, char **argv)
+ opts.object_name = obj_name;
+ obj = bpf_object__open_mem(obj_data, file_sz, &opts);
+ if (IS_ERR(obj)) {
++ char err_buf[256];
++
++ libbpf_strerror(PTR_ERR(obj), err_buf, sizeof(err_buf));
++ p_err("failed to open BPF object file: %s", err_buf);
+ obj = NULL;
+- p_err("failed to open BPF object file: %ld", PTR_ERR(obj));
+ goto out;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 2f49f89984efa611179a02761f9a193cbcbbd759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 19:15:40 +0800
+Subject: tools, bpftool: Fix wrong return value in do_dump()
+
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+[ Upstream commit 041549b7b2c7811ec40e705c439211f00ade2dda ]
+
+In case of btf_id does not exist, a negative error code -ENOENT
+should be returned.
+
+Fixes: c93cc69004df3 ("bpftool: add ability to dump BTF types")
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Tobias Klauser <tklauser@distanz.ch>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200802111540.5384-1-tianjia.zhang@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
+index faac8189b2853..c2f1fd414820a 100644
+--- a/tools/bpf/bpftool/btf.c
++++ b/tools/bpf/bpftool/btf.c
+@@ -596,7 +596,7 @@ static int do_dump(int argc, char **argv)
+ goto done;
+ }
+ if (!btf) {
+- err = ENOENT;
++ err = -ENOENT;
+ p_err("can't find btf with ID (%u)", btf_id);
+ goto done;
+ }
+--
+2.25.1
+
--- /dev/null
+From 2b8c0c8481453c0d31d55d740223380db1567b73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 19:42:44 -0700
+Subject: tools, build: Propagate build failures from
+ tools/build/Makefile.build
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit a278f3d8191228212c553a5d4303fa603214b717 ]
+
+The '&&' command seems to have a bad effect when $(cmd_$(1)) exits with
+non-zero effect: the command failure is masked (despite `set -e`) and all but
+the first command of $(dep-cmd) is executed (successfully, as they are mostly
+printfs), thus overall returning 0 in the end.
+
+This means in practice that despite compilation errors, tools's build Makefile
+will return success. We see this very reliably with libbpf's Makefile, which
+doesn't get compilation error propagated properly. This in turns causes issues
+with selftests build, as well as bpftool and other projects that rely on
+building libbpf.
+
+The fix is simple: don't use &&. Given `set -e`, we don't need to chain
+commands with &&. The shell will exit on first failure, giving desired
+behavior and propagating error properly.
+
+Fixes: 275e2d95591e ("tools build: Move dependency copy into function")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/bpf/20200731024244.872574-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/Build.include | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/build/Build.include b/tools/build/Build.include
+index 9ec01f4454f9f..585486e40995b 100644
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -74,7 +74,8 @@ dep-cmd = $(if $(wildcard $(fixdep)),
+ # dependencies in the cmd file
+ if_changed_dep = $(if $(strip $(any-prereq) $(arg-check)), \
+ @set -e; \
+- $(echo-cmd) $(cmd_$(1)) && $(dep-cmd))
++ $(echo-cmd) $(cmd_$(1)); \
++ $(dep-cmd))
+
+ # if_changed - execute command if any prerequisite is newer than
+ # target, or command line has changed
+--
+2.25.1
+
--- /dev/null
+From 4f48ccb1ce97a3ea7406e62a85445e27c3c4d620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 14:29:55 -0500
+Subject: tpm: Require that all digests are present in TCG_PCR_EVENT2
+ structures
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit 7f3d176f5f7e3f0477bf82df0f600fcddcdcc4e4 ]
+
+Require that the TCG_PCR_EVENT2.digests.count value strictly matches the
+value of TCG_EfiSpecIdEvent.numberOfAlgorithms in the event field of the
+TCG_PCClientPCREvent event log header. Also require that
+TCG_EfiSpecIdEvent.numberOfAlgorithms is non-zero.
+
+The TCG PC Client Platform Firmware Profile Specification section 9.1
+(Family "2.0", Level 00 Revision 1.04) states:
+
+ For each Hash algorithm enumerated in the TCG_PCClientPCREvent entry,
+ there SHALL be a corresponding digest in all TCG_PCR_EVENT2 structures.
+ Note: This includes EV_NO_ACTION events which do not extend the PCR.
+
+Section 9.4.5.1 provides this description of
+TCG_EfiSpecIdEvent.numberOfAlgorithms:
+
+ The number of Hash algorithms in the digestSizes field. This field MUST
+ be set to a value of 0x01 or greater.
+
+Enforce these restrictions, as required by the above specification, in
+order to better identify and ignore invalid sequences of bytes at the
+end of an otherwise valid TPM2 event log. Firmware doesn't always have
+the means necessary to inform the kernel of the actual event log size so
+the kernel's event log parsing code should be stringent when parsing the
+event log for resiliency against firmware bugs. This is true, for
+example, when firmware passes the event log to the kernel via a reserved
+memory region described in device tree.
+
+POWER and some ARM systems use the "linux,sml-base" and "linux,sml-size"
+device tree properties to describe the memory region used to pass the
+event log from firmware to the kernel. Unfortunately, the
+"linux,sml-size" property describes the size of the entire reserved
+memory region rather than the size of the event long within the memory
+region and the event log format does not include information describing
+the size of the event log.
+
+tpm_read_log_of(), in drivers/char/tpm/eventlog/of.c, is where the
+"linux,sml-size" property is used. At the end of that function,
+log->bios_event_log_end is pointing at the end of the reserved memory
+region. That's typically 0x10000 bytes offset from "linux,sml-base",
+depending on what's defined in the device tree source.
+
+The firmware event log only fills a portion of those 0x10000 bytes and
+the rest of the memory region should be zeroed out by firmware. Even in
+the case of a properly zeroed bytes in the remainder of the memory
+region, the only thing allowing the kernel's event log parser to detect
+the end of the event log is the following conditional in
+__calc_tpm2_event_size():
+
+ if (event_type == 0 && event_field->event_size == 0)
+ size = 0;
+
+If that wasn't there, __calc_tpm2_event_size() would think that a 16
+byte sequence of zeroes, following an otherwise valid event log, was
+a valid event.
+
+However, problems can occur if a single bit is set in the offset
+corresponding to either the TCG_PCR_EVENT2.eventType or
+TCG_PCR_EVENT2.eventSize fields, after the last valid event log entry.
+This could confuse the parser into thinking that an additional entry is
+present in the event log and exposing this invalid entry to userspace in
+the /sys/kernel/security/tpm0/binary_bios_measurements file. Such
+problems have been seen if firmware does not fully zero the memory
+region upon a warm reboot.
+
+This patch significantly raises the bar on how difficult it is for
+stale/invalid memory to confuse the kernel's event log parser but
+there's still, ultimately, a reliance on firmware to properly initialize
+the remainder of the memory region reserved for the event log as the
+parser cannot be expected to detect a stale but otherwise properly
+formatted firmware event log entry.
+
+Fixes: fd5c78694f3f ("tpm: fix handling of the TPM 2.0 event logs")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/tpm_eventlog.h | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h
+index 64356b199e945..739ba9a03ec16 100644
+--- a/include/linux/tpm_eventlog.h
++++ b/include/linux/tpm_eventlog.h
+@@ -211,9 +211,16 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
+
+ efispecid = (struct tcg_efi_specid_event_head *)event_header->event;
+
+- /* Check if event is malformed. */
++ /*
++ * Perform validation of the event in order to identify malformed
++ * events. This function may be asked to parse arbitrary byte sequences
++ * immediately following a valid event log. The caller expects this
++ * function to recognize that the byte sequence is not a valid event
++ * and to return an event size of 0.
++ */
+ if (memcmp(efispecid->signature, TCG_SPECID_SIG,
+- sizeof(TCG_SPECID_SIG)) || count > efispecid->num_algs) {
++ sizeof(TCG_SPECID_SIG)) ||
++ !efispecid->num_algs || count != efispecid->num_algs) {
+ size = 0;
+ goto out;
+ }
+--
+2.25.1
+
--- /dev/null
+From ea7af07fb8986051c3a0898d711c6c37e6f87d9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 23:45:56 -0400
+Subject: tracing: Move pipe reference to trace array instead of current_tracer
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit 7ef282e05132d56b6f6b71e3873f317664bea78b ]
+
+If a process has the trace_pipe open on a trace_array, the current tracer
+for that trace array should not be changed. This was original enforced by a
+global lock, but when instances were introduced, it was moved to the
+current_trace. But this structure is shared by all instances, and a
+trace_pipe is for a single instance. There's no reason that a process that
+has trace_pipe open on one instance should prevent another instance from
+changing its current tracer. Move the reference counter to the trace_array
+instead.
+
+This is marked as "Fixes" but is more of a clean up than a true fix.
+Backport if you want, but its not critical.
+
+Fixes: cf6ab6d9143b1 ("tracing: Add ref count to tracer for when they are being read by pipe")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace.c | 12 ++++++------
+ kernel/trace/trace.h | 2 +-
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index bb62269724d5f..6fc6da55b94e2 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -5887,7 +5887,7 @@ int tracing_set_tracer(struct trace_array *tr, const char *buf)
+ }
+
+ /* If trace pipe files are being read, we can't change the tracer */
+- if (tr->current_trace->ref) {
++ if (tr->trace_ref) {
+ ret = -EBUSY;
+ goto out;
+ }
+@@ -6103,7 +6103,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
+
+ nonseekable_open(inode, filp);
+
+- tr->current_trace->ref++;
++ tr->trace_ref++;
+ out:
+ mutex_unlock(&trace_types_lock);
+ return ret;
+@@ -6122,7 +6122,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file)
+
+ mutex_lock(&trace_types_lock);
+
+- tr->current_trace->ref--;
++ tr->trace_ref--;
+
+ if (iter->trace->pipe_close)
+ iter->trace->pipe_close(iter);
+@@ -7424,7 +7424,7 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp)
+
+ filp->private_data = info;
+
+- tr->current_trace->ref++;
++ tr->trace_ref++;
+
+ mutex_unlock(&trace_types_lock);
+
+@@ -7525,7 +7525,7 @@ static int tracing_buffers_release(struct inode *inode, struct file *file)
+
+ mutex_lock(&trace_types_lock);
+
+- iter->tr->current_trace->ref--;
++ iter->tr->trace_ref--;
+
+ __trace_array_put(iter->tr);
+
+@@ -8733,7 +8733,7 @@ static int __remove_instance(struct trace_array *tr)
+ int i;
+
+ /* Reference counter for a newly created trace array = 1. */
+- if (tr->ref > 1 || (tr->current_trace && tr->current_trace->ref))
++ if (tr->ref > 1 || (tr->current_trace && tr->trace_ref))
+ return -EBUSY;
+
+ list_del(&tr->list);
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 13db4000af3fe..f21607f871891 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -356,6 +356,7 @@ struct trace_array {
+ struct trace_event_file *trace_marker_file;
+ cpumask_var_t tracing_cpumask; /* only trace on set CPUs */
+ int ref;
++ int trace_ref;
+ #ifdef CONFIG_FUNCTION_TRACER
+ struct ftrace_ops *ops;
+ struct trace_pid_list __rcu *function_pids;
+@@ -547,7 +548,6 @@ struct tracer {
+ struct tracer *next;
+ struct tracer_flags *flags;
+ int enabled;
+- int ref;
+ bool print_max;
+ bool allow_instances;
+ #ifdef CONFIG_TRACER_MAX_TRACE
+--
+2.25.1
+
--- /dev/null
+From d5435d20fab803be372a151ae49f08273c84e24b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 13:07:45 -0400
+Subject: usb: bdc: Halt controller on suspend
+
+From: Danesh Petigara <danesh.petigara@broadcom.com>
+
+[ Upstream commit 5fc453d7de3d0c345812453823a3a56783c5f82c ]
+
+GISB bus error kernel panics have been observed during S2 transition
+tests on the 7271t platform. The errors are a result of the BDC
+interrupt handler trying to access BDC register space after the
+system's suspend callbacks have completed.
+
+Adding a suspend hook to the BDC driver that halts the controller before
+S2 entry thus preventing unwanted access to the BDC register space during
+this transition.
+
+Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
+Signed-off-by: Al Cooper <alcooperx@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/bdc/bdc_core.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
+index 5fde5a8b065c1..2dca11f0a7444 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
+@@ -603,9 +603,14 @@ static int bdc_remove(struct platform_device *pdev)
+ static int bdc_suspend(struct device *dev)
+ {
+ struct bdc *bdc = dev_get_drvdata(dev);
++ int ret;
+
+- clk_disable_unprepare(bdc->clk);
+- return 0;
++ /* Halt the controller */
++ ret = bdc_stop(bdc);
++ if (!ret)
++ clk_disable_unprepare(bdc->clk);
++
++ return ret;
+ }
+
+ static int bdc_resume(struct device *dev)
+--
+2.25.1
+
--- /dev/null
+From 3d0932db0b19cf7bcb25eeabe7ea5e2f52210e0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 16:43:50 +0200
+Subject: usb: core: fix quirks_param_set() writing to a const pointer
+
+From: Kars Mulder <kerneldev@karsmulder.nl>
+
+[ Upstream commit b1b6bed3b5036509b449b5965285d5057ba42527 ]
+
+The function quirks_param_set() takes as argument a const char* pointer
+to the new value of the usbcore.quirks parameter. It then casts this
+pointer to a non-const char* pointer and passes it to the strsep()
+function, which overwrites the value.
+
+Fix this by creating a copy of the value using kstrdup() and letting
+that copy be written to by strsep().
+
+Fixes: 027bd6cafd9a ("usb: core: Add "quirks" parameter for usbcore")
+Signed-off-by: Kars Mulder <kerneldev@karsmulder.nl>
+
+Link: https://lore.kernel.org/r/5ee2-5f048a00-21-618c5c00@230659773
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/quirks.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index e0b77674869ce..c96c50faccf72 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -25,17 +25,23 @@ static unsigned int quirk_count;
+
+ static char quirks_param[128];
+
+-static int quirks_param_set(const char *val, const struct kernel_param *kp)
++static int quirks_param_set(const char *value, const struct kernel_param *kp)
+ {
+- char *p, *field;
++ char *val, *p, *field;
+ u16 vid, pid;
+ u32 flags;
+ size_t i;
+ int err;
+
++ val = kstrdup(value, GFP_KERNEL);
++ if (!val)
++ return -ENOMEM;
++
+ err = param_set_copystring(val, kp);
+- if (err)
++ if (err) {
++ kfree(val);
+ return err;
++ }
+
+ mutex_lock(&quirk_mutex);
+
+@@ -60,10 +66,11 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
+ if (!quirk_list) {
+ quirk_count = 0;
+ mutex_unlock(&quirk_mutex);
++ kfree(val);
+ return -ENOMEM;
+ }
+
+- for (i = 0, p = (char *)val; p && *p;) {
++ for (i = 0, p = val; p && *p;) {
+ /* Each entry consists of VID:PID:flags */
+ field = strsep(&p, ":");
+ if (!field)
+@@ -144,6 +151,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
+
+ unlock:
+ mutex_unlock(&quirk_mutex);
++ kfree(val);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 829661c5a5087045ea51a1d9fde4045bc1a879d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 14:09:48 +0200
+Subject: usb: dwc2: Fix error path in gadget registration
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 33a06f1300a79cfd461cea0268f05e969d4f34ec ]
+
+When gadget registration fails, one should not call usb_del_gadget_udc().
+Ensure this by setting gadget->udc to NULL. Also in case of a failure
+there is no need to disable low-level hardware, so return immiedetly
+instead of jumping to error_init label.
+
+This fixes the following kernel NULL ptr dereference on gadget failure
+(can be easily triggered with g_mass_storage without any module
+parameters):
+
+dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
+dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
+dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
+Mass Storage Function, version: 2009/09/11
+LUN: removable file: (no medium)
+no file given for LUN0
+g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
+8<--- cut here ---
+Unable to handle kernel NULL pointer dereference at virtual address 00000104
+pgd = (ptrval)
+[00000104] *pgd=00000000
+Internal error: Oops: 805 [#1] PREEMPT SMP ARM
+Modules linked in:
+CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc5 #3133
+Hardware name: Samsung Exynos (Flattened Device Tree)
+Workqueue: events deferred_probe_work_func
+PC is at usb_del_gadget_udc+0x38/0xc4
+LR is at __mutex_lock+0x31c/0xb18
+...
+Process kworker/0:1 (pid: 12, stack limit = 0x(ptrval))
+Stack: (0xef121db0 to 0xef122000)
+...
+[<c076bf3c>] (usb_del_gadget_udc) from [<c0726bec>] (dwc2_hsotg_remove+0x10/0x20)
+[<c0726bec>] (dwc2_hsotg_remove) from [<c0711208>] (dwc2_driver_probe+0x57c/0x69c)
+[<c0711208>] (dwc2_driver_probe) from [<c06247c0>] (platform_drv_probe+0x6c/0xa4)
+[<c06247c0>] (platform_drv_probe) from [<c0621df4>] (really_probe+0x200/0x48c)
+[<c0621df4>] (really_probe) from [<c06221e8>] (driver_probe_device+0x78/0x1fc)
+[<c06221e8>] (driver_probe_device) from [<c061fcd4>] (bus_for_each_drv+0x74/0xb8)
+[<c061fcd4>] (bus_for_each_drv) from [<c0621b54>] (__device_attach+0xd4/0x16c)
+[<c0621b54>] (__device_attach) from [<c0620c98>] (bus_probe_device+0x88/0x90)
+[<c0620c98>] (bus_probe_device) from [<c06211b0>] (deferred_probe_work_func+0x3c/0xd0)
+[<c06211b0>] (deferred_probe_work_func) from [<c0149280>] (process_one_work+0x234/0x7dc)
+[<c0149280>] (process_one_work) from [<c014986c>] (worker_thread+0x44/0x51c)
+[<c014986c>] (worker_thread) from [<c0150b1c>] (kthread+0x158/0x1a0)
+[<c0150b1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
+Exception stack(0xef121fb0 to 0xef121ff8)
+...
+---[ end trace 9724c2fc7cc9c982 ]---
+
+While fixing this also fix the double call to dwc2_lowlevel_hw_disable()
+if dr_mode is set to USB_DR_MODE_PERIPHERAL. In such case low-level
+hardware is already disabled before calling usb_add_gadget_udc(). That
+function correctly preserves low-level hardware state, there is no need
+for the second unconditional dwc2_lowlevel_hw_disable() call.
+
+Fixes: 207324a321a8 ("usb: dwc2: Postponed gadget registration to the udc class driver")
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/platform.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index cb8ddbd537187..db9fd4bd1a38c 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -582,6 +582,7 @@ static int dwc2_driver_probe(struct platform_device *dev)
+ if (hsotg->gadget_enabled) {
+ retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
+ if (retval) {
++ hsotg->gadget.udc = NULL;
+ dwc2_hsotg_remove(hsotg);
+ goto error_init;
+ }
+@@ -593,7 +594,8 @@ static int dwc2_driver_probe(struct platform_device *dev)
+ if (hsotg->params.activate_stm_id_vb_detection)
+ regulator_disable(hsotg->usb33d);
+ error:
+- dwc2_lowlevel_hw_disable(hsotg);
++ if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL)
++ dwc2_lowlevel_hw_disable(hsotg);
+ return retval;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 1176a171148807f0b06e2a81d7fd84306f89c550 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 12:05:22 -0400
+Subject: usb: dwc3: meson-g12a: fix shared reset control use
+
+From: Dan Robertson <dan@dlrobertson.com>
+
+[ Upstream commit 7a410953d1fb4dbe91ffcfdee9cbbf889d19b0d7 ]
+
+The reset is a shared reset line, but reset_control_reset is still used
+and reset_control_deassert is not guaranteed to have been called before
+the first reset_control_assert call. When suspending the following
+warning may be seen:
+
+WARNING: CPU: 1 PID: 5530 at drivers/reset/core.c:355 reset_control_assert+0x184/0x19c
+Hardware name: Hardkernel ODROID-N2 (DT)
+[..]
+pc : reset_control_assert+0x184/0x19c
+lr : dwc3_meson_g12a_suspend+0x68/0x7c
+[..]
+Call trace:
+ reset_control_assert+0x184/0x19c
+ dwc3_meson_g12a_suspend+0x68/0x7c
+ platform_pm_suspend+0x28/0x54
+ __device_suspend+0x590/0xabc
+ dpm_suspend+0x104/0x404
+ dpm_suspend_start+0x84/0x1bc
+ suspend_devices_and_enter+0xc4/0x4fc
+ pm_suspend+0x198/0x2d4
+
+Fixes: 6d9fa35a347a87 ("usb: dwc3: meson-g12a: get the reset as shared")
+Signed-off-by: Dan Robertson <dan@dlrobertson.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
+index 1f7f4d88ed9d8..88b75b5a039c9 100644
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -737,13 +737,13 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+ goto err_disable_clks;
+ }
+
+- ret = reset_control_reset(priv->reset);
++ ret = reset_control_deassert(priv->reset);
+ if (ret)
+- goto err_disable_clks;
++ goto err_assert_reset;
+
+ ret = dwc3_meson_g12a_get_phys(priv);
+ if (ret)
+- goto err_disable_clks;
++ goto err_assert_reset;
+
+ ret = priv->drvdata->setup_regmaps(priv, base);
+ if (ret)
+@@ -752,7 +752,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+ if (priv->vbus) {
+ ret = regulator_enable(priv->vbus);
+ if (ret)
+- goto err_disable_clks;
++ goto err_assert_reset;
+ }
+
+ /* Get dr_mode */
+@@ -765,13 +765,13 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+
+ ret = priv->drvdata->usb_init(priv);
+ if (ret)
+- goto err_disable_clks;
++ goto err_assert_reset;
+
+ /* Init PHYs */
+ for (i = 0 ; i < PHY_COUNT ; ++i) {
+ ret = phy_init(priv->phys[i]);
+ if (ret)
+- goto err_disable_clks;
++ goto err_assert_reset;
+ }
+
+ /* Set PHY Power */
+@@ -809,6 +809,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev)
+ for (i = 0 ; i < PHY_COUNT ; ++i)
+ phy_exit(priv->phys[i]);
+
++err_assert_reset:
++ reset_control_assert(priv->reset);
++
+ err_disable_clks:
+ clk_bulk_disable_unprepare(priv->drvdata->num_clks,
+ priv->drvdata->clks);
+--
+2.25.1
+
--- /dev/null
+From 1015c1813ca224fc550cd2d7826669e18dc94ca1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 16:49:03 +0300
+Subject: usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength
+
+From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+
+[ Upstream commit a9cf8715180b18c62addbfe6f6267b8101903119 ]
+
+As per UAC2 spec (ch. 4.7.2), wTotalLength of AC Interface
+Header Descriptor "includes the combined length of this
+descriptor header and all Clock Source, Unit and Terminal
+descriptors."
+
+Thus add its size to its wTotalLength.
+
+Also after recent changes wTotalLength is calculated
+dynamically, update static definition of uac2_ac_header_descriptor
+accordingly
+
+Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver")
+Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_uac2.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
+index db2d4980cb354..3633df6d7610f 100644
+--- a/drivers/usb/gadget/function/f_uac2.c
++++ b/drivers/usb/gadget/function/f_uac2.c
+@@ -215,10 +215,7 @@ static struct uac2_ac_header_descriptor ac_hdr_desc = {
+ .bDescriptorSubtype = UAC_MS_HEADER,
+ .bcdADC = cpu_to_le16(0x200),
+ .bCategory = UAC2_FUNCTION_IO_BOX,
+- .wTotalLength = cpu_to_le16(sizeof in_clk_src_desc
+- + sizeof out_clk_src_desc + sizeof usb_out_it_desc
+- + sizeof io_in_it_desc + sizeof usb_in_ot_desc
+- + sizeof io_out_ot_desc),
++ /* .wTotalLength = DYNAMIC */
+ .bmControls = 0,
+ };
+
+@@ -501,7 +498,7 @@ static void setup_descriptor(struct f_uac2_opts *opts)
+ as_in_hdr_desc.bTerminalLink = usb_in_ot_desc.bTerminalID;
+
+ iad_desc.bInterfaceCount = 1;
+- ac_hdr_desc.wTotalLength = 0;
++ ac_hdr_desc.wTotalLength = cpu_to_le16(sizeof(ac_hdr_desc));
+
+ if (EPIN_EN(opts)) {
+ u16 len = le16_to_cpu(ac_hdr_desc.wTotalLength);
+--
+2.25.1
+
--- /dev/null
+From c401323a6eacc955bdbf2cf7e6bf9f376bae49f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 23:15:58 +0300
+Subject: usb: gadget: net2280: fix memory leak on probe error handling paths
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 2468c877da428ebfd701142c4cdfefcfb7d4c00e ]
+
+Driver does not release memory for device on error handling paths in
+net2280_probe() when gadget_release() is not registered yet.
+
+The patch fixes the bug like in other similar drivers.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/net2280.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
+index 5eff85eeaa5a0..7530bd9a08c43 100644
+--- a/drivers/usb/gadget/udc/net2280.c
++++ b/drivers/usb/gadget/udc/net2280.c
+@@ -3781,8 +3781,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return 0;
+
+ done:
+- if (dev)
++ if (dev) {
+ net2280_remove(pdev);
++ kfree(dev);
++ }
+ return retval;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 071b0f2de1bbc3e17ac60fe1ef815529686af29d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 15:14:59 +0800
+Subject: usb: mtu3: clear dual mode of u3port when disable device
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit f1e51e99ed498d4aa9ae5df28e43d558ea627781 ]
+
+If not clear u3port's dual mode when disable device, the IP
+will fail to enter sleep mode when suspend.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1595834101-13094-10-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mtu3/mtu3_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
+index 9dd02160cca97..e3780d4d65149 100644
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -131,8 +131,12 @@ static void mtu3_device_disable(struct mtu3 *mtu)
+ mtu3_setbits(ibase, SSUSB_U2_CTRL(0),
+ SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN);
+
+- if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG)
++ if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) {
+ mtu3_clrbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL);
++ if (mtu->is_u3_ip)
++ mtu3_clrbits(ibase, SSUSB_U3_CTRL(0),
++ SSUSB_U3_PORT_DUAL_MODE);
++ }
+
+ mtu3_setbits(ibase, U3D_SSUSB_IP_PW_CTRL2, SSUSB_IP_DEV_PDN);
+ }
+--
+2.25.1
+
--- /dev/null
+From 964d90756e3f9c7584d1c2e7720aee1f2f6db7f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 10:50:55 +0200
+Subject: USB: serial: iuu_phoenix: fix led-activity helpers
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit de37458f8c2bfc465500a1dd0d15dbe96d2a698c ]
+
+The set-led command is eight bytes long and starts with a command byte
+followed by six bytes of RGB data and ends with a byte encoding a
+frequency (see iuu_led() and iuu_rgbf_fill_buffer()).
+
+The led activity helpers had a few long-standing bugs which corrupted
+the command packets by inserting a second command byte and thereby
+offsetting the RGB data and dropping the frequency in non-xmas mode.
+
+In xmas mode, a related off-by-one error left the frequency field
+uninitialised.
+
+Fixes: 60a8fc017103 ("USB: add iuu_phoenix driver")
+Reported-by: George Spelvin <lkml@sdf.org>
+Link: https://lore.kernel.org/r/20200716085056.31471-1-johan@kernel.org
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/iuu_phoenix.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
+index b8dfeb4fb2ed6..ffbb2a8901b2b 100644
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -353,10 +353,11 @@ static void iuu_led_activity_on(struct urb *urb)
+ struct usb_serial_port *port = urb->context;
+ int result;
+ char *buf_ptr = port->write_urb->transfer_buffer;
+- *buf_ptr++ = IUU_SET_LED;
++
+ if (xmas) {
+- get_random_bytes(buf_ptr, 6);
+- *(buf_ptr+7) = 1;
++ buf_ptr[0] = IUU_SET_LED;
++ get_random_bytes(buf_ptr + 1, 6);
++ buf_ptr[7] = 1;
+ } else {
+ iuu_rgbf_fill_buffer(buf_ptr, 255, 255, 0, 0, 0, 0, 255);
+ }
+@@ -374,13 +375,14 @@ static void iuu_led_activity_off(struct urb *urb)
+ struct usb_serial_port *port = urb->context;
+ int result;
+ char *buf_ptr = port->write_urb->transfer_buffer;
++
+ if (xmas) {
+ iuu_rxcmd(urb);
+ return;
+- } else {
+- *buf_ptr++ = IUU_SET_LED;
+- iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255);
+ }
++
++ iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255);
++
+ usb_fill_bulk_urb(port->write_urb, port->serial->dev,
+ usb_sndbulkpipe(port->serial->dev,
+ port->bulk_out_endpointAddress),
+--
+2.25.1
+
--- /dev/null
+From 5d769030e8432666fa3b5fb94910c77916155cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 22:54:51 +0300
+Subject: video: fbdev: neofb: fix memory leak in neo_scan_monitor()
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit edcb3895a751c762a18d25c8d9846ce9759ed7e1 ]
+
+neofb_probe() calls neo_scan_monitor() that can successfully allocate a
+memory for info->monspecs.modedb and proceed to case 0x03. There it does
+not free the memory and returns -1. neofb_probe() goes to label
+err_scan_monitor, thus, it does not free this memory through calling
+fb_destroy_modedb() as well. We can not go to label err_init_hw since
+neo_scan_monitor() can fail during memory allocation. So, the patch frees
+the memory directly for case 0x03.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200630195451.18675-1-novikov@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/neofb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c
+index f5a676bfd67ad..09a20d4ab35f2 100644
+--- a/drivers/video/fbdev/neofb.c
++++ b/drivers/video/fbdev/neofb.c
+@@ -1819,6 +1819,7 @@ static int neo_scan_monitor(struct fb_info *info)
+ #else
+ printk(KERN_ERR
+ "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n");
++ kfree(info->monspecs.modedb);
+ return -1;
+ #endif
+ default:
+--
+2.25.1
+
--- /dev/null
+From c58f65e3e261f6cf055664cdd5d26cc3d336b100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 19:21:36 +0300
+Subject: video: fbdev: savage: fix memory leak on error handling path in probe
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit e8d35898a78e34fc854ed9680bc3f9caedab08cd ]
+
+savagefb_probe() calls savage_init_fb_info() that can successfully
+allocate memory for info->pixmap.addr but then fail when
+fb_alloc_cmap() fails. savagefb_probe() goes to label failed_init and
+does not free allocated memory. It is not valid to go to label
+failed_mmio since savage_init_fb_info() can fail during memory
+allocation as well. So, the patch free allocated memory on the error
+handling path in savage_init_fb_info() itself.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Cc: Antonino Daplas <adaplas@gmail.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200619162136.9010-1-novikov@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/savage/savagefb_driver.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c
+index 3c8ae87f0ea7d..3fd87aeb6c798 100644
+--- a/drivers/video/fbdev/savage/savagefb_driver.c
++++ b/drivers/video/fbdev/savage/savagefb_driver.c
+@@ -2157,6 +2157,8 @@ static int savage_init_fb_info(struct fb_info *info, struct pci_dev *dev,
+ info->flags |= FBINFO_HWACCEL_COPYAREA |
+ FBINFO_HWACCEL_FILLRECT |
+ FBINFO_HWACCEL_IMAGEBLIT;
++ else
++ kfree(info->pixmap.addr);
+ }
+ #endif
+ return err;
+--
+2.25.1
+
--- /dev/null
+From a08f2fffb99df45037c71e65656f4858fdea249b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Apr 2020 00:07:19 +0800
+Subject: video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
+
+From: Dejin Zheng <zhengdejin5@gmail.com>
+
+[ Upstream commit 98bd4f72988646c35569e1e838c0ab80d06c77f6 ]
+
+the sfb->fb->screen_base is not save the value get by iounmap() when
+the chip id is 0x720. so iounmap() for address sfb->fb->screen_base
+is not right.
+
+Fixes: 1461d6672864854 ("staging: sm7xxfb: merge sm712fb with fbdev")
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200422160719.27763-1-zhengdejin5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sm712fb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 6a1b4a853d9ee..8cd655d6d6280 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1429,6 +1429,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb,
+ static void smtc_unmap_smem(struct smtcfb_info *sfb)
+ {
+ if (sfb && sfb->fb->screen_base) {
++ if (sfb->chip_id == 0x720)
++ sfb->fb->screen_base -= 0x00200000;
+ iounmap(sfb->fb->screen_base);
+ sfb->fb->screen_base = NULL;
+ }
+--
+2.25.1
+
--- /dev/null
+From ff16526e6809fe329f976d9c6c6963c820df323d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Apr 2020 10:45:05 +0200
+Subject: video: pxafb: Fix the function used to balance a
+ 'dma_alloc_coherent()' call
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 499a2c41b954518c372873202d5e7714e22010c4 ]
+
+'dma_alloc_coherent()' must be balanced by a call to 'dma_free_coherent()'
+not 'dma_free_wc()'.
+The correct dma_free_ function is already used in the error handling path
+of the probe function.
+
+Fixes: 77e196752bdd ("[ARM] pxafb: allow video memory size to be configurable")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: Jani Nikula <jani.nikula@intel.com>
+cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Cc: Eric Miao <eric.miao@marvell.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200429084505.108897-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/pxafb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
+index 00b96a78676ef..6f972bed410a9 100644
+--- a/drivers/video/fbdev/pxafb.c
++++ b/drivers/video/fbdev/pxafb.c
+@@ -2417,8 +2417,8 @@ static int pxafb_remove(struct platform_device *dev)
+
+ free_pages_exact(fbi->video_mem, fbi->video_mem_size);
+
+- dma_free_wc(&dev->dev, fbi->dma_buff_size, fbi->dma_buff,
+- fbi->dma_buff_phys);
++ dma_free_coherent(&dev->dev, fbi->dma_buff_size, fbi->dma_buff,
++ fbi->dma_buff_phys);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 1e6051f73f7fa56ea22105099eca8b2976aedeee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 15:39:39 +0800
+Subject: wl1251: fix always return 0 error
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 20e6421344b5bc2f97b8e2db47b6994368417904 ]
+
+wl1251_event_ps_report() should not always return 0 because
+wl1251_ps_set_mode() may fail. Change it to return 'ret'.
+
+Fixes: f7ad1eed4d4b ("wl1251: retry power save entry")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200730073939.33704-1-wanghai38@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wl1251/event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
+index 850864dbafa11..e6d426edab56b 100644
+--- a/drivers/net/wireless/ti/wl1251/event.c
++++ b/drivers/net/wireless/ti/wl1251/event.c
+@@ -70,7 +70,7 @@ static int wl1251_event_ps_report(struct wl1251 *wl,
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static void wl1251_event_mbox_dump(struct event_mailbox *mbox)
+--
+2.25.1
+
--- /dev/null
+From ecad34473c1ad13b4d151521427915717398db5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jun 2020 10:32:38 +0800
+Subject: x86/mce/inject: Fix a wrong assignment of i_mce.status
+
+From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+
+[ Upstream commit 5d7f7d1d5e01c22894dee7c9c9266500478dca99 ]
+
+The original code is a nop as i_mce.status is or'ed with part of itself,
+fix it.
+
+Fixes: a1300e505297 ("x86/ras/mce_amd_inj: Trigger deferred and thresholding errors interrupts")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Link: https://lkml.kernel.org/r/20200611023238.3830-1-zhenzhong.duan@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/inject.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c
+index 0593b192eb8fa..7843ab3fde099 100644
+--- a/arch/x86/kernel/cpu/mce/inject.c
++++ b/arch/x86/kernel/cpu/mce/inject.c
+@@ -511,7 +511,7 @@ static void do_inject(void)
+ */
+ if (inj_type == DFR_INT_INJ) {
+ i_mce.status |= MCI_STATUS_DEFERRED;
+- i_mce.status |= (i_mce.status & ~MCI_STATUS_UC);
++ i_mce.status &= ~MCI_STATUS_UC;
+ }
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From 267872724df1d7d874d74b64720297fe3e298185 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 20:24:52 +0200
+Subject: x86, sched: Bail out of frequency invariance if turbo frequency is
+ unknown
+
+From: Giovanni Gherdovich <ggherdovich@suse.cz>
+
+[ Upstream commit 51beea8862a3095559862df39554f05042e1195b ]
+
+There may be CPUs that support turbo boost but don't declare any turbo
+ratio, i.e. their MSR_TURBO_RATIO_LIMIT is all zeroes. In that condition
+scale-invariant calculations can't be performed.
+
+Fixes: 1567c3e3467c ("x86, sched: Add support for frequency invariance")
+Suggested-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Signed-off-by: Giovanni Gherdovich <ggherdovich@suse.cz>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Tested-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Link: https://lkml.kernel.org/r/20200531182453.15254-3-ggherdovich@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/smpboot.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 18d292fc466cb..20e1cea262e4b 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -2002,9 +2002,11 @@ static bool intel_set_max_freq_ratio(void)
+ /*
+ * Some hypervisors advertise X86_FEATURE_APERFMPERF
+ * but then fill all MSR's with zeroes.
++ * Some CPUs have turbo boost but don't declare any turbo ratio
++ * in MSR_TURBO_RATIO_LIMIT.
+ */
+- if (!base_freq) {
+- pr_debug("Couldn't determine cpu base frequency, necessary for scale-invariant accounting.\n");
++ if (!base_freq || !turbo_freq) {
++ pr_debug("Couldn't determine cpu base or turbo frequency, necessary for scale-invariant accounting.\n");
+ return false;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 859d16d98a050e9cfbde9f2519b14f9401ee37aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 20:24:53 +0200
+Subject: x86, sched: Bail out of frequency invariance if turbo_freq/base_freq
+ gives 0
+
+From: Giovanni Gherdovich <ggherdovich@suse.cz>
+
+[ Upstream commit f4291df103315a696f0b8c4f45ca8ae773c17441 ]
+
+Be defensive against the case where the processor reports a base_freq
+larger than turbo_freq (the ratio would be zero).
+
+Fixes: 1567c3e3467c ("x86, sched: Add support for frequency invariance")
+Signed-off-by: Giovanni Gherdovich <ggherdovich@suse.cz>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lkml.kernel.org/r/20200531182453.15254-4-ggherdovich@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/smpboot.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 20e1cea262e4b..518ac6bf752e0 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1977,6 +1977,7 @@ static bool core_set_max_freq_ratio(u64 *base_freq, u64 *turbo_freq)
+ static bool intel_set_max_freq_ratio(void)
+ {
+ u64 base_freq, turbo_freq;
++ u64 turbo_ratio;
+
+ if (slv_set_max_freq_ratio(&base_freq, &turbo_freq))
+ goto out;
+@@ -2010,9 +2011,15 @@ static bool intel_set_max_freq_ratio(void)
+ return false;
+ }
+
+- arch_turbo_freq_ratio = div_u64(turbo_freq * SCHED_CAPACITY_SCALE,
+- base_freq);
++ turbo_ratio = div_u64(turbo_freq * SCHED_CAPACITY_SCALE, base_freq);
++ if (!turbo_ratio) {
++ pr_debug("Non-zero turbo and base frequencies led to a 0 ratio.\n");
++ return false;
++ }
++
++ arch_turbo_freq_ratio = turbo_ratio;
+ arch_set_max_freq_ratio(turbo_disabled());
++
+ return true;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From bdc8716979b317ae99f4306d6b32ddf37a7c795a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 20:24:51 +0200
+Subject: x86, sched: check for counters overflow in frequency invariant
+ accounting
+
+From: Giovanni Gherdovich <ggherdovich@suse.cz>
+
+[ Upstream commit e2b0d619b400ae326f954a018a1d65d736c237c5 ]
+
+The product mcnt * arch_max_freq_ratio can overflows u64.
+
+For context, a large value for arch_max_freq_ratio would be 5000,
+corresponding to a turbo_freq/base_freq ratio of 5 (normally it's more like
+1500-2000). A large increment frequency for the MPERF counter would be 5GHz
+(the base clock of all CPUs on the market today is less than that). With
+these figures, a CPU would need to go without a scheduler tick for around 8
+days for the u64 overflow to happen. It is unlikely, but the check is
+warranted.
+
+Under similar conditions, the difference acnt of two consecutive APERF
+readings can overflow as well.
+
+In these circumstances is appropriate to disable frequency invariant
+accounting: the feature relies on measures of the clock frequency done at
+every scheduler tick, which need to be "fresh" to be at all meaningful.
+
+A note on i386: prior to version 5.1, the GCC compiler didn't have the
+builtin function __builtin_mul_overflow. In these GCC versions the macro
+check_mul_overflow needs __udivdi3() to do (u64)a/b, which the kernel
+doesn't provide. For this reason this change fails to build on i386 if
+GCC<5.1, and we protect the entire frequency invariant code behind
+CONFIG_X86_64 (special thanks to "kbuild test robot" <lkp@intel.com>).
+
+Fixes: 1567c3e3467c ("x86, sched: Add support for frequency invariance")
+Signed-off-by: Giovanni Gherdovich <ggherdovich@suse.cz>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lkml.kernel.org/r/20200531182453.15254-2-ggherdovich@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/topology.h | 2 +-
+ arch/x86/kernel/smpboot.c | 33 ++++++++++++++++++++++++++++-----
+ 2 files changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
+index 79d8d54963303..f4234575f3fdb 100644
+--- a/arch/x86/include/asm/topology.h
++++ b/arch/x86/include/asm/topology.h
+@@ -193,7 +193,7 @@ static inline void sched_clear_itmt_support(void)
+ }
+ #endif /* CONFIG_SCHED_MC_PRIO */
+
+-#ifdef CONFIG_SMP
++#if defined(CONFIG_SMP) && defined(CONFIG_X86_64)
+ #include <asm/cpufeature.h>
+
+ DECLARE_STATIC_KEY_FALSE(arch_scale_freq_key);
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index ffbd9a3d78d84..18d292fc466cb 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -56,6 +56,7 @@
+ #include <linux/cpuidle.h>
+ #include <linux/numa.h>
+ #include <linux/pgtable.h>
++#include <linux/overflow.h>
+
+ #include <asm/acpi.h>
+ #include <asm/desc.h>
+@@ -1777,6 +1778,7 @@ void native_play_dead(void)
+
+ #endif
+
++#ifdef CONFIG_X86_64
+ /*
+ * APERF/MPERF frequency ratio computation.
+ *
+@@ -2048,11 +2050,19 @@ static void init_freq_invariance(bool secondary)
+ }
+ }
+
++static void disable_freq_invariance_workfn(struct work_struct *work)
++{
++ static_branch_disable(&arch_scale_freq_key);
++}
++
++static DECLARE_WORK(disable_freq_invariance_work,
++ disable_freq_invariance_workfn);
++
+ DEFINE_PER_CPU(unsigned long, arch_freq_scale) = SCHED_CAPACITY_SCALE;
+
+ void arch_scale_freq_tick(void)
+ {
+- u64 freq_scale;
++ u64 freq_scale = SCHED_CAPACITY_SCALE;
+ u64 aperf, mperf;
+ u64 acnt, mcnt;
+
+@@ -2064,19 +2074,32 @@ void arch_scale_freq_tick(void)
+
+ acnt = aperf - this_cpu_read(arch_prev_aperf);
+ mcnt = mperf - this_cpu_read(arch_prev_mperf);
+- if (!mcnt)
+- return;
+
+ this_cpu_write(arch_prev_aperf, aperf);
+ this_cpu_write(arch_prev_mperf, mperf);
+
+- acnt <<= 2*SCHED_CAPACITY_SHIFT;
+- mcnt *= arch_max_freq_ratio;
++ if (check_shl_overflow(acnt, 2*SCHED_CAPACITY_SHIFT, &acnt))
++ goto error;
++
++ if (check_mul_overflow(mcnt, arch_max_freq_ratio, &mcnt) || !mcnt)
++ goto error;
+
+ freq_scale = div64_u64(acnt, mcnt);
++ if (!freq_scale)
++ goto error;
+
+ if (freq_scale > SCHED_CAPACITY_SCALE)
+ freq_scale = SCHED_CAPACITY_SCALE;
+
+ this_cpu_write(arch_freq_scale, freq_scale);
++ return;
++
++error:
++ pr_warn("Scheduler frequency invariance went wobbly, disabling!\n");
++ schedule_work(&disable_freq_invariance_work);
++}
++#else
++static inline void init_freq_invariance(bool secondary)
++{
+ }
++#endif /* CONFIG_X86_64 */
+--
+2.25.1
+
--- /dev/null
+From e1d543eef31e4f87c4b928a50c5a1bc40f06e6cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 13:49:25 -0700
+Subject: x86/uaccess: Make __get_user_size() Clang compliant on 32-bit
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 158807de5822d1079e162a3762956fd743dd483e ]
+
+Clang fails to compile __get_user_size() on 32-bit for the following code:
+
+ long long val;
+
+ __get_user(val, usrptr);
+
+with: error: invalid output size for constraint '=q'
+
+GCC compiles the same code without complaints.
+
+The reason is that GCC and Clang are architecturally different, which leads
+to subtle issues for code that's invalid but clearly dead, i.e. with code
+that emulates polymorphism with the preprocessor and sizeof.
+
+GCC will perform semantic analysis after early inlining and dead code
+elimination, so it will not warn on invalid code that's dead. Clang
+strictly performs optimizations after semantic analysis, so it will warn
+for dead code.
+
+Neither Clang nor GCC like this very much with -m32:
+
+long long ret;
+asm ("movb $5, %0" : "=q" (ret));
+
+However, GCC can tolerate this variant:
+
+long long ret;
+switch (sizeof(ret)) {
+case 1:
+ asm ("movb $5, %0" : "=q" (ret));
+ break;
+case 8:;
+}
+
+Clang, on the other hand, won't accept that because it validates the inline
+asm for the '1' case before the optimisation phase where it realises that
+it wouldn't have to emit it anyway.
+
+If LLVM (Clang's "back end") fails such as during instruction selection or
+register allocation, it cannot provide accurate diagnostics (warnings /
+errors) that contain line information, as the AST has been discarded from
+memory at that point.
+
+While there have been early discussions about having C/C++ specific
+language optimizations in Clang via the use of MLIR, which would enable
+such earlier optimizations, such work is not scoped and likely a multi-year
+endeavor.
+
+It was discussed to change the asm output constraint for the one byte case
+from "=q" to "=r". While it works for 64-bit, it fails on 32-bit. With '=r'
+the compiler could fail to chose a register accessible as high/low which is
+required for the byte operation. If that happens the assembly will fail.
+
+Use a local temporary variable of type 'unsigned char' as output for the
+byte copy inline asm and then assign it to the real output variable. This
+prevents Clang from failing the semantic analysis in the above case.
+
+The resulting code for the actual one byte copy is not affected as the
+temporary variable is optimized out.
+
+[ tglx: Amended changelog ]
+
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Reported-by: David Woodhouse <dwmw2@infradead.org>
+Reported-by: Dmitry Golovin <dima@golovin.in>
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Dennis Zhou <dennis@kernel.org>
+Link: https://bugs.llvm.org/show_bug.cgi?id=33587
+Link: https://github.com/ClangBuiltLinux/linux/issues/3
+Link: https://github.com/ClangBuiltLinux/linux/issues/194
+Link: https://github.com/ClangBuiltLinux/linux/issues/781
+Link: https://lore.kernel.org/lkml/20180209161833.4605-1-dwmw2@infradead.org/
+Link: https://lore.kernel.org/lkml/CAK8P3a1EBaWdbAEzirFDSgHVJMtWjuNt2HGG8z+vpXeNHwETFQ@mail.gmail.com/
+Link: https://lkml.kernel.org/r/20200720204925.3654302-12-ndesaulniers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/uaccess.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 18dfa07d3ef0d..2f3e8f2a958f6 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -314,11 +314,14 @@ do { \
+
+ #define __get_user_size(x, ptr, size, retval) \
+ do { \
++ unsigned char x_u8__; \
++ \
+ retval = 0; \
+ __chk_user_ptr(ptr); \
+ switch (size) { \
+ case 1: \
+- __get_user_asm(x, ptr, retval, "b", "=q"); \
++ __get_user_asm(x_u8__, ptr, retval, "b", "=q"); \
++ (x) = x_u8__; \
+ break; \
+ case 2: \
+ __get_user_asm(x, ptr, retval, "w", "=r"); \
+--
+2.25.1
+
--- /dev/null
+From 88acf464f3ee95a4816b79b897a87128d5d7f9be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 10:36:08 -0700
+Subject: xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit c97738a960a86081a147e7d436138e6481757445 ]
+
+In commit 8d3d7e2b35ea, we changed xfs_qm_dqpurge to bail out if we
+can't lock the dquot buf to flush the dquot. This prevents the AIL from
+blocking on the dquot, but it also forgets to clear the FREEING flag on
+its way out. A subsequent purge attempt will see the FREEING flag is
+set and bail out, which leads to dqpurge_all failing to purge all the
+dquots.
+
+(copy-pasting from Dave Chinner's identical patch)
+
+This was found by inspection after having xfs/305 hang 1 in ~50
+iterations in a quotaoff operation:
+
+[ 8872.301115] xfs_quota D13888 92262 91813 0x00004002
+[ 8872.302538] Call Trace:
+[ 8872.303193] __schedule+0x2d2/0x780
+[ 8872.304108] ? do_raw_spin_unlock+0x57/0xd0
+[ 8872.305198] schedule+0x6e/0xe0
+[ 8872.306021] schedule_timeout+0x14d/0x300
+[ 8872.307060] ? __next_timer_interrupt+0xe0/0xe0
+[ 8872.308231] ? xfs_qm_dqusage_adjust+0x200/0x200
+[ 8872.309422] schedule_timeout_uninterruptible+0x2a/0x30
+[ 8872.310759] xfs_qm_dquot_walk.isra.0+0x15a/0x1b0
+[ 8872.311971] xfs_qm_dqpurge_all+0x7f/0x90
+[ 8872.313022] xfs_qm_scall_quotaoff+0x18d/0x2b0
+[ 8872.314163] xfs_quota_disable+0x3a/0x60
+[ 8872.315179] kernel_quotactl+0x7e2/0x8d0
+[ 8872.316196] ? __do_sys_newstat+0x51/0x80
+[ 8872.317238] __x64_sys_quotactl+0x1e/0x30
+[ 8872.318266] do_syscall_64+0x46/0x90
+[ 8872.319193] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 8872.320490] RIP: 0033:0x7f46b5490f2a
+[ 8872.321414] Code: Bad RIP value.
+
+Returning -EAGAIN from xfs_qm_dqpurge() without clearing the
+XFS_DQ_FREEING flag means the xfs_qm_dqpurge_all() code can never
+free the dquot, and we loop forever waiting for the XFS_DQ_FREEING
+flag to go away on the dquot that leaked it via -EAGAIN.
+
+Fixes: 8d3d7e2b35ea ("xfs: trylock underlying buffer on dquot flush")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Allison Collins <allison.henderson@oracle.com>
+Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_qm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
+index d6cd833173447..938023dd8ce5d 100644
+--- a/fs/xfs/xfs_qm.c
++++ b/fs/xfs/xfs_qm.c
+@@ -148,6 +148,7 @@ xfs_qm_dqpurge(
+ error = xfs_bwrite(bp);
+ xfs_buf_relse(bp);
+ } else if (error == -EAGAIN) {
++ dqp->dq_flags &= ~XFS_DQ_FREEING;
+ goto out_unlock;
+ }
+ xfs_dqflock(dqp);
+--
+2.25.1
+
--- /dev/null
+From ba92dcb631452214f4618257acd10f449f463cf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 14:47:17 -0700
+Subject: xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit eb0efe5063bb10bcb653e4f8e92a74719c03a347 ]
+
+The data fork scrubber calls filemap_write_and_wait to flush dirty pages
+and delalloc reservations out to disk prior to checking the data fork's
+extent mappings. Unfortunately, this means that scrub can consume the
+EIO/ENOSPC errors that would otherwise have stayed around in the address
+space until (we hope) the writer application calls fsync to persist data
+and collect errors. The end result is that programs that wrote to a
+file might never see the error code and proceed as if nothing were
+wrong.
+
+xfs_scrub is not in a position to notify file writers about the
+writeback failure, and it's only here to check metadata, not file
+contents. Therefore, if writeback fails, we should stuff the error code
+back into the address space so that an fsync by the writer application
+can pick that up.
+
+Fixes: 99d9d8d05da2 ("xfs: scrub inode block mappings")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/scrub/bmap.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
+index 7badd6dfe5449..955302e7cdde9 100644
+--- a/fs/xfs/scrub/bmap.c
++++ b/fs/xfs/scrub/bmap.c
+@@ -45,9 +45,27 @@ xchk_setup_inode_bmap(
+ */
+ if (S_ISREG(VFS_I(sc->ip)->i_mode) &&
+ sc->sm->sm_type == XFS_SCRUB_TYPE_BMBTD) {
++ struct address_space *mapping = VFS_I(sc->ip)->i_mapping;
++
+ inode_dio_wait(VFS_I(sc->ip));
+- error = filemap_write_and_wait(VFS_I(sc->ip)->i_mapping);
+- if (error)
++
++ /*
++ * Try to flush all incore state to disk before we examine the
++ * space mappings for the data fork. Leave accumulated errors
++ * in the mapping for the writer threads to consume.
++ *
++ * On ENOSPC or EIO writeback errors, we continue into the
++ * extent mapping checks because write failures do not
++ * necessarily imply anything about the correctness of the file
++ * metadata. The metadata and the file data could be on
++ * completely separate devices; a media failure might only
++ * affect a subset of the disk, etc. We can handle delalloc
++ * extents in the scrubber, so leaving them in memory is fine.
++ */
++ error = filemap_fdatawrite(mapping);
++ if (!error)
++ error = filemap_fdatawait_keep_errors(mapping);
++ if (error && (error != -ENOSPC && error != -EIO))
+ goto out;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 43397ec7da4f9a54add0e3865867e12b893ef294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 18:44:50 -0700
+Subject: xfs: fix inode allocation block res calculation precedence
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit b2a8864728683443f34a9fd33a2b78b860934cc1 ]
+
+The block reservation calculation for inode allocation is supposed
+to consist of the blocks required for the inode chunk plus
+(maxlevels-1) of the inode btree multiplied by the number of inode
+btrees in the fs (2 when finobt is enabled, 1 otherwise).
+
+Instead, the macro returns (ialloc_blocks + 2) due to a precedence
+error in the calculation logic. This leads to block reservation
+overruns via generic/531 on small block filesystems with finobt
+enabled. Add braces to fix the calculation and reserve the
+appropriate number of blocks.
+
+Fixes: 9d43b180af67 ("xfs: update inode allocation/free transaction reservations for finobt")
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_trans_space.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_space.h b/fs/xfs/libxfs/xfs_trans_space.h
+index 88221c7a04ccf..c6df01a2a1585 100644
+--- a/fs/xfs/libxfs/xfs_trans_space.h
++++ b/fs/xfs/libxfs/xfs_trans_space.h
+@@ -57,7 +57,7 @@
+ XFS_DAREMOVE_SPACE_RES(mp, XFS_DATA_FORK)
+ #define XFS_IALLOC_SPACE_RES(mp) \
+ (M_IGEO(mp)->ialloc_blks + \
+- (xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1 * \
++ ((xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1) * \
+ (M_IGEO(mp)->inobt_maxlevels - 1)))
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From 67353455ad603956a924e998897516b41fc0aa8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 14:47:18 -0700
+Subject: xfs: fix reflink quota reservation accounting error
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 83895227aba1ade33e81f586aa7b6b1e143096a5 ]
+
+Quota reservations are supposed to account for the blocks that might be
+allocated due to a bmap btree split. Reflink doesn't do this, so fix
+this to make the quota accounting more accurate before we start
+rearranging things.
+
+Fixes: 862bb360ef56 ("xfs: reflink extents from one file to another")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_reflink.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
+index 107bf2a2f3448..d89201d40891f 100644
+--- a/fs/xfs/xfs_reflink.c
++++ b/fs/xfs/xfs_reflink.c
+@@ -1003,6 +1003,7 @@ xfs_reflink_remap_extent(
+ xfs_filblks_t rlen;
+ xfs_filblks_t unmap_len;
+ xfs_off_t newlen;
++ int64_t qres;
+ int error;
+
+ unmap_len = irec->br_startoff + irec->br_blockcount - destoff;
+@@ -1025,13 +1026,19 @@ xfs_reflink_remap_extent(
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+ xfs_trans_ijoin(tp, ip, 0);
+
+- /* If we're not just clearing space, then do we have enough quota? */
+- if (real_extent) {
+- error = xfs_trans_reserve_quota_nblks(tp, ip,
+- irec->br_blockcount, 0, XFS_QMOPT_RES_REGBLKS);
+- if (error)
+- goto out_cancel;
+- }
++ /*
++ * Reserve quota for this operation. We don't know if the first unmap
++ * in the dest file will cause a bmap btree split, so we always reserve
++ * at least enough blocks for that split. If the extent being mapped
++ * in is written, we need to reserve quota for that too.
++ */
++ qres = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK);
++ if (real_extent)
++ qres += irec->br_blockcount;
++ error = xfs_trans_reserve_quota_nblks(tp, ip, qres, 0,
++ XFS_QMOPT_RES_REGBLKS);
++ if (error)
++ goto out_cancel;
+
+ trace_xfs_reflink_remap(ip, irec->br_startoff,
+ irec->br_blockcount, irec->br_startblock);
+--
+2.25.1
+
--- /dev/null
+From 07fa3bbc3782bde3e9781e0f637c41f13e8b6530 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 14:44:36 -0700
+Subject: xfs: preserve rmapbt swapext block reservation from freed blocks
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit f74681ba2006434be195402e0b15fc5763cddd7e ]
+
+The rmapbt extent swap algorithm remaps individual extents between
+the source inode and the target to trigger reverse mapping metadata
+updates. If either inode straddles a format or other bmap allocation
+boundary, the individual unmap and map cycles can trigger repeated
+bmap block allocations and frees as the extent count bounces back
+and forth across the boundary. While net block usage is bound across
+the swap operation, this behavior can prematurely exhaust the
+transaction block reservation because it continuously drains as the
+transaction rolls. Each allocation accounts against the reservation
+and each free returns to global free space on transaction roll.
+
+The previous workaround to this problem attempted to detect this
+boundary condition and provide surplus block reservation to
+acommodate it. This is insufficient because more remaps can occur
+than implied by the extent counts; if start offset boundaries are
+not aligned between the two inodes, for example.
+
+To address this problem more generically and dynamically, add a
+transaction accounting mode that returns freed blocks to the
+transaction reservation instead of the superblock counters on
+transaction roll and use it when the rmapbt based algorithm is
+active. This allows the chain of remap transactions to preserve the
+block reservation based own its own frees and prevent premature
+exhaustion regardless of the remap pattern. Note that this is only
+safe for superblocks with lazy sb accounting, but the latter is
+required for v5 supers and the rmap feature depends on v5.
+
+Fixes: b3fed434822d0 ("xfs: account format bouncing into rmapbt swapext tx reservation")
+Root-caused-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_shared.h | 1 +
+ fs/xfs/xfs_bmap_util.c | 18 +++++++++---------
+ fs/xfs/xfs_trans.c | 19 ++++++++++++++++++-
+ 3 files changed, 28 insertions(+), 10 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_shared.h b/fs/xfs/libxfs/xfs_shared.h
+index c45acbd3add94..708feb8eac766 100644
+--- a/fs/xfs/libxfs/xfs_shared.h
++++ b/fs/xfs/libxfs/xfs_shared.h
+@@ -65,6 +65,7 @@ void xfs_log_get_max_trans_res(struct xfs_mount *mp,
+ #define XFS_TRANS_DQ_DIRTY 0x10 /* at least one dquot in trx dirty */
+ #define XFS_TRANS_RESERVE 0x20 /* OK to use reserved data blocks */
+ #define XFS_TRANS_NO_WRITECOUNT 0x40 /* do not elevate SB writecount */
++#define XFS_TRANS_RES_FDBLKS 0x80 /* reserve newly freed blocks */
+ /*
+ * LOWMODE is used by the allocator to activate the lowspace algorithm - when
+ * free space is running low the extent allocator may choose to allocate an
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index f37f5cc4b19ff..afdc7f8e0e701 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1567,6 +1567,7 @@ xfs_swap_extents(
+ int lock_flags;
+ uint64_t f;
+ int resblks = 0;
++ unsigned int flags = 0;
+
+ /*
+ * Lock the inodes against other IO, page faults and truncate to
+@@ -1630,17 +1631,16 @@ xfs_swap_extents(
+ resblks += XFS_SWAP_RMAP_SPACE_RES(mp, tipnext, w);
+
+ /*
+- * Handle the corner case where either inode might straddle the
+- * btree format boundary. If so, the inode could bounce between
+- * btree <-> extent format on unmap -> remap cycles, freeing and
+- * allocating a bmapbt block each time.
++ * If either inode straddles a bmapbt block allocation boundary,
++ * the rmapbt algorithm triggers repeated allocs and frees as
++ * extents are remapped. This can exhaust the block reservation
++ * prematurely and cause shutdown. Return freed blocks to the
++ * transaction reservation to counter this behavior.
+ */
+- if (ipnext == (XFS_IFORK_MAXEXT(ip, w) + 1))
+- resblks += XFS_IFORK_MAXEXT(ip, w);
+- if (tipnext == (XFS_IFORK_MAXEXT(tip, w) + 1))
+- resblks += XFS_IFORK_MAXEXT(tip, w);
++ flags |= XFS_TRANS_RES_FDBLKS;
+ }
+- error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0, 0, &tp);
++ error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0, flags,
++ &tp);
+ if (error)
+ goto out_unlock;
+
+diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
+index 3c94e5ff43160..0ad72a83edac4 100644
+--- a/fs/xfs/xfs_trans.c
++++ b/fs/xfs/xfs_trans.c
+@@ -107,7 +107,8 @@ xfs_trans_dup(
+
+ ntp->t_flags = XFS_TRANS_PERM_LOG_RES |
+ (tp->t_flags & XFS_TRANS_RESERVE) |
+- (tp->t_flags & XFS_TRANS_NO_WRITECOUNT);
++ (tp->t_flags & XFS_TRANS_NO_WRITECOUNT) |
++ (tp->t_flags & XFS_TRANS_RES_FDBLKS);
+ /* We gave our writer reference to the new transaction */
+ tp->t_flags |= XFS_TRANS_NO_WRITECOUNT;
+ ntp->t_ticket = xfs_log_ticket_get(tp->t_ticket);
+@@ -272,6 +273,8 @@ xfs_trans_alloc(
+ */
+ WARN_ON(resp->tr_logres > 0 &&
+ mp->m_super->s_writers.frozen == SB_FREEZE_COMPLETE);
++ ASSERT(!(flags & XFS_TRANS_RES_FDBLKS) ||
++ xfs_sb_version_haslazysbcount(&mp->m_sb));
+
+ tp->t_magic = XFS_TRANS_HEADER_MAGIC;
+ tp->t_flags = flags;
+@@ -365,6 +368,20 @@ xfs_trans_mod_sb(
+ tp->t_blk_res_used += (uint)-delta;
+ if (tp->t_blk_res_used > tp->t_blk_res)
+ xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
++ } else if (delta > 0 && (tp->t_flags & XFS_TRANS_RES_FDBLKS)) {
++ int64_t blkres_delta;
++
++ /*
++ * Return freed blocks directly to the reservation
++ * instead of the global pool, being careful not to
++ * overflow the trans counter. This is used to preserve
++ * reservation across chains of transaction rolls that
++ * repeatedly free and allocate blocks.
++ */
++ blkres_delta = min_t(int64_t, delta,
++ UINT_MAX - tp->t_blk_res);
++ tp->t_blk_res += blkres_delta;
++ delta -= blkres_delta;
+ }
+ tp->t_fdblocks_delta += delta;
+ if (xfs_sb_version_haslazysbcount(&mp->m_sb))
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
